This vulnerability (CWE-639) in Scripta eScriptorium affects the process and annotation taxonomy serializers up to version 26.04.1. A remote authenticated user can supply part primary keys to a many=True related field, which lacks proper queryset restriction on its child_relation. This allows the user to run segmentation and transcription operations on document parts owned by other users, resulting in unauthorized overwriting of their content. The issue stems from incorrect application of queryset restrictions in the serializer's related fields.

An authenticated attacker can bypass authorization controls to modify document parts belonging to other users, causing integrity loss of user data. There is no impact on confidentiality or availability reported. The CVSS score is 6.5 (medium severity), reflecting the potential for unauthorized data modification without privilege escalation or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided at this time. Until a patch is available, restrict access to trusted users and monitor for suspicious activity related to document part modifications.