CVE-2026-125373
Received Received - Intake

Authorization Bypass in IETF Datatracker

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125373
EUVD
EUVD-2026-120536

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ietf-tools datatracker From 0 (inc) to 12.83.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in IETF Datatracker before version 12.83.0. It allows NomCom role holders to access other committees' records by exploiting sequential primary keys. Attackers can view confidential nominee identities, reclassify feedback, and change nominee email addresses through functions like view_feedback_nominee and edit_nominee.

Detection Guidance

To detect this vulnerability, check if your IETF Datatracker version is below 12.83.0. Review access logs for unauthorized access to view_feedback_nominee, view_feedback_topic, view_feedback_unrelated, or edit_nominee functions. Look for sequential primary key manipulation in URLs or form submissions.

Impact Analysis

If you are a NomCom role holder, this vulnerability could allow you to access sensitive data belonging to other committees, such as confidential nominee identities or feedback. It could also enable unauthorized modifications to nominee email addresses or feedback reclassification, leading to data leaks or integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It may result in non-compliance with regulations mandating strict access controls and data integrity.

Mitigation Strategies

Immediately upgrade to IETF Datatracker version 12.83.0 or later. Review and restrict NomCom role permissions to prevent unauthorized access. Audit all feedback and nominee records for unauthorized modifications or access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...