Description
The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar's owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user's role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization's cookiejar by UUID and have the crawler use that organization's stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization's session data.


The vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization's stored cookies and session data through the crawler infrastructure.
Published: 2026-09-25
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to stored cookies and session data
Action: Patch Immediately
AI Analysis

Impact

The AIL Framework crawler task creation API contained an insufficient authorization check that allowed an authenticated user to attach a cookiejar belonging to another organization to a crawler task. The original code only verified existence and ownership for access level 0 cookiejars, and performed no check for other access levels. This flaw lets attackers leech another organization’s session cookies and authentication tokens through the crawler, exposing sensitive data.

Affected Systems

The vulnerability affects the Ail Framework, specifically the crawler task creation endpoint (api_add_crawler_task). No specific version information is listed, but it applies to any release before the patch that implements ACL enforcement.

Risk and Exploitability

The CVSS score of 6.3 indicates a medium impact. There is no EPSS score available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an authenticated user with permission to create crawler tasks and knowledge of a valid cookiejar UUID from another organization. The attacker cannot bypass authentication entirely, but once authenticated, can acquire another organization’s stored cookies through the crawler infrastructure.

Generated by OpenCVE AI on September 25, 2026 at 16:40 UTC.

Remediation

Vendor Solution

The cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the 'view' action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing.

OpenCVE Recommended Actions

  • Apply the vendor patch that updates api_add_crawler_task to enforce organization, user, and role-based ACL checks on cookiejar attachment and URL scheme validation.
  • Verify that all crawler task creation requests invoke the api_check_cookiejar_access_acl() function for cookiejar access control.
  • Until the patch is applied, restrict crawler task creation to cookiejars that belong to the user’s own organization by adding a temporary filter that rejects cross-organization UUIDs.

Generated by OpenCVE AI on September 25, 2026 at 16:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Ail-project
Ail-project ail-framework
Vendors & Products Ail-project
Ail-project ail-framework

Fri, 25 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar's owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user's role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization's cookiejar by UUID and have the crawler use that organization's stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization's session data. The vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization's stored cookies and session data through the crawler infrastructure.
Title Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment
Weaknesses CWE-20
CWE-639
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Ail-project Ail-framework
cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-09-25T14:55:51.640Z

Reserved: 2026-09-25T13:35:37.184Z

Link: CVE-2026-100177

cve-icon Vulnrichment

Updated: 2026-09-25T14:55:43.929Z

cve-icon NVD

Status : Deferred

Published: 2026-09-25T14:17:17.223

Modified: 2026-09-25T15:17:52.523

Link: CVE-2026-100177

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T12:30:07Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-639

    Authorization Bypass Through User-Controlled Key