https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:55:33 +0000 https://db.gcve.eu/vuln/cve-2026-100177 <p><strong>Affected:</strong> ail project ail framework</p> <p>The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar&#39;s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user&#39;s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization&#39;s cookiejar by UUID and have the crawler use that organization&#39;s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization&#39;s session data.</p> <p>The vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization&#39;s stored cookies and session data through the crawler infrastructure.</p> <p><strong>Affected:</strong> ail project ail framework</p> <p>The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar&#39;s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user&#39;s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization&#39;s cookiejar by UUID and have the crawler use that organization&#39;s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization&#39;s session data.</p> <p>The vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization&#39;s stored cookies and session data through the crawler infrastructure.</p> https://db.gcve.eu/vuln/cve-2026-100177