The vulnerability is a missing authorization check in the OcrModelRight create and delete views of Scripta eScriptorium. This flaw permits any authenticated user to grant themselves or revoke others' access to a user's private OCR model through a POST request. Because the ownership check is placed only in get_context_data() and therefore runs only during the GET rendering path, the POST method bypasses the safety guard. The result is unauthorized access to confidential OCR data, which could also lead to denial of service for the affected models.

Scripta eScriptorium versions up to 26.04.1, as well as older branches before the fix, are affected. The vendor recommends upgrading to the fixed releases 26.04.2, 1.0.1, or 0.13.9.

The CVSS score of 7.1 indicates moderate to high severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely by any authenticated user via POST requests, giving attackers the ability to grant or revoke access to private OCR models. In environments where OCR outputs contain sensitive information, the risk is significant.