An authorization bypass vulnerability in Scripta eScriptorium allows authenticated users to access or modify data via unauthorized API calls.

The vulnerability is an authorization bypass (CWE-639) affecting the Line, LineTranscription, VirtualCollection, tag, and process API endpoints. A low-privileged authenticated user can manipulate parameters to gain access to resources they should not be authorized to view or modify.

With a CVSS score of 8.8, this flaw presents a high risk of unauthorized data access and manipulation. If exploited, an attacker could compromise the integrity and confidentiality of the entire dataset managed by eScriptorium, leading to significant reputational damage and loss of data governance.

Immediate Action: Upgrade eScriptorium to version 26.04.2, 1.0.1, or 0.13.9 to address the authorization flaws.

Proactive Monitoring: Review API access logs for anomalous behavior, specifically looking for users attempting to access resource IDs that fall outside their typical scope of operation.

Compensating Controls: If an immediate update is not possible, restrict access to the API endpoints via a Web Application Firewall (WAF) or by implementing strict network-level access controls.

Public Exploit Available: No

The severity of this authorization bypass necessitates an immediate update to the specified fixed versions. Security teams should verify that all API integrations are updated and that access control policies are reviewed to ensure no further unauthorized access is possible.