The AIL Framework's api_add_crawler_task API does not properly enforce authorization when attaching a cookiejar UUID to crawler tasks. The code only verifies cookiejar existence and, if the cookiejar's access level is 0, compares the owning user ID to the requesting user ID, but it does not validate organizational boundaries or the requesting user's role. For cookiejars with access level other than 0, no access check is performed. This allows an authenticated user with crawler task creation rights to use cookiejars from other organizations, leading to unauthorized access to stored cookies and session data.

An attacker who is authenticated and able to create crawler tasks can access cookiejars from other organizations by referencing their UUIDs. This results in unauthorized access to session tokens and authentication credentials stored in those cookiejars, potentially leading to session data leakage or exfiltration across organizational boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict crawler task creation permissions to trusted users and monitor for suspicious use of cookiejar UUIDs. Validate organizational boundaries and user roles in any custom implementations or workarounds.