The vulnerability arises from missing authorization in the websocket consumer component of Scripta eScriptorium through version 26.04.1. A remote authenticated user can exploit this by subscribing to any document's event stream without proper access checks. Specifically, the object_cls and object_pk values in a join-room message are passed to group_add without verifying the user's permission, allowing unauthorized observation of other users' document-related activities such as segmentation, transcription, import, export, and training.

An authenticated user can gain unauthorized read access to event streams of documents they do not have permission to view. This leads to information disclosure of another user's document processing activities, potentially exposing sensitive workflow details. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict websocket access to trusted users and monitor for unusual subscription patterns. Avoid sharing credentials with untrusted parties to limit exploitation risk.