This vulnerability in Scripta eScriptorium affects the OcrModelRight create and delete views. The ownership check to verify user permissions is implemented in the get_context_data() method, which is only invoked during GET requests. Consequently, POST requests that create or delete access rights do not properly verify ownership, enabling an authenticated user to escalate their privileges by granting or revoking access to OCR models they do not own. This affects all versions before 26.04.2.

An authenticated attacker can manipulate access controls on OCR models, granting themselves unauthorized access to private models of other users or revoking legitimate users' access. This leads to unauthorized modification of access rights, potentially disrupting legitimate use and compromising confidentiality of OCR models. There is no direct confidentiality impact on the OCR model content itself, but integrity of access control is compromised. Availability impact is low but present due to possible revocation of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted authenticated users only and monitor for suspicious access control changes. Avoid using affected versions prior to 26.04.2 in sensitive environments if possible.