This vulnerability (CWE-862) in Scripta eScriptorium's websocket consumer allows remote authenticated users to bypass authorization controls. By manipulating the object_cls and object_pk parameters in a join-room message, an attacker can subscribe to event streams of arbitrary documents. This lack of access checks in group_add calls leads to unauthorized visibility into other users' document-related activities such as segmentation, transcription, import, export, and training. The issue affects versions through 26.04.1. No official patch or remediation guidance is currently available.

An attacker with valid authentication credentials can observe sensitive user activities related to documents they should not have access to. This results in unauthorized information disclosure of document processing events. There is no indication of impact on data integrity or availability. The confidentiality impact is limited but notable due to exposure of user activity streams.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict websocket consumer access to trusted users only and monitor for unusual subscription requests. Implement additional access control checks on the server side if possible to prevent unauthorized group_add calls.