This vulnerability in Scripta eScriptorium allows a remote authenticated user to grant themselves access to another user's private OCR model and revoke any user's OCR model access via POST requests. The root cause is that the ownership check is implemented in get_context_data(), which is executed only during GET request rendering, leaving POST request handling unprotected. This missing authorization (CWE-862) leads to improper access control on sensitive OCR model resources.

An authenticated attacker can escalate privileges by granting themselves access to private OCR models belonging to other users and revoke access rights of any user. This compromises the integrity of access controls within the application, potentially disrupting legitimate user operations and exposing sensitive OCR data. The vulnerability does not affect confidentiality but impacts integrity and availability of OCR model access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected views to trusted users only and monitor for suspicious activity related to OCR model access changes. Implement additional authorization checks on POST request handlers to ensure ownership validation is enforced consistently.