The vulnerability is an authorization bypass that allows a remote authenticated user to specify a primary key in the request body for various API endpoints (Line, LineTranscription, VirtualCollection, tag, process) and have the request be served against a global model manager. This lets the attacker read, modify, or delete another user’s transcription content. The weakness corresponds to CWE‑639—Authorization Bypass Through User‑Controlled Key. The impact is loss of confidentiality and integrity of user data, and potentially denial of service if data is deleted.

The product affected is Scripta’s eScriptorium. Versions up to 26.04.1, 1.0.0, and 0.13.8 are impacted as the fix is available in 26.04.2, 1.0.1, and 0.13.9. Exact version ranges are not fully enumerated in the advisory, so any deployment older than the listed patch versions should be considered vulnerable.

The CVSS score of 8.8 indicates a high severity risk. Although the EPSS score is not available, the vulnerability is described as exploitable by a remote authenticated user. The bug is not in CISA KEV, so it is not currently known to be actively exploited. Attackers would need valid authentication credentials and access to the API; no elevated privileges are required beyond legitimate user rights. The enabling condition is the presence of unvalidated user‑controlled keys in the request body, which the application currently accepts and forwards to a global model manager.