Description
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
Published: 2026-09-28
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authentication bypass in GEOritm REST API
Action: Immediate Upgrade
AI Analysis

Impact

A flaw in the GEOritm REST API allows manipulation of the objectId argument in the /restapi/objects/obj-groups endpoint, bypassing required authentication checks. This results in an authentication bypass (CWE-287) and missing authentication (CWE-306). Attackers can perform unauthorized group management actions, accessing or modifying group data, which can compromise confidentiality and integrity of the system.

Affected Systems

The vulnerability impacts ООО НПО Ритм GEOritm versions up to and including 2.45.1. The affected component is the REST API path /restapi/objects/obj-groups. Customers using these versions are at risk until they upgrade to version 2.46 or later, which contains the vendor patch.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate to high risk. The EPSS score is unavailable, but the vulnerability is publicly known and exploitable. Attackers can launch it remotely by sending crafted requests that manipulate the objectId parameter, bypassing authentication. The issue is not listed in the CISA KEV catalog, but public exploits exist, indicating a realistic threat for exposed REST APIs.

Generated by OpenCVE AI on September 28, 2026 at 05:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update GEOritm to version 2.46 or newer to apply the vendor-supplied fix.
  • Ensure that the /restapi/objects/obj-groups endpoint enforces proper authentication before processing any request, adding an authorization check if it is missing.
  • Limit access to the REST API by implementing network-level controls such as IP whitelisting or VPN restrictions to reduce the attack surface while the patch is in place.

Generated by OpenCVE AI on September 28, 2026 at 05:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Ооо Нпо Ритм
Ооо Нпо Ритм georitm
Vendors & Products Ооо Нпо Ритм
Ооо Нпо Ритм georitm

Mon, 28 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
References

Mon, 28 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
Title ООО НПО Ритм GEOritm REST API obj-groups missing authentication
First Time appeared
georitm
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:_:georitm:*:*:*:*:*:*:*:*
Vendors & Products
georitm
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Georitm
Ооо Нпо Ритм Georitm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T14:03:25.159Z

Reserved: 2026-09-27T08:59:57.846Z

Link: CVE-2026-100903

cve-icon Vulnrichment

Updated: 2026-10-01T14:03:18.252Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T04:17:07.690

Modified: 2026-10-01T15:17:19.620

Link: CVE-2026-100903

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T16:23:25Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function