CVE-2026-100177
Deferred Deferred - Pending Action

Unauthorized Cookiejar Access in AIL Framework

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: CIRCL

Description
The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar's owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user's role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization's cookiejar by UUID and have the crawler use that organization's stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization's session data. The vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization's stored cookies and session data through the crawler infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-16
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-100177
EUVD
EUVD-2026-87091

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ail_project ail_framework 0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AIL Framework crawler task creation API had a flaw in authorization checks. When creating crawler tasks, the system did not properly verify if a user could access a cookiejar UUID belonging to another organization. This allowed authenticated users to attach another organization's cookiejar to their crawler tasks, potentially exposing stored session tokens and authentication credentials.

Detection Guidance

To detect this vulnerability, monitor API logs for the AIL Framework crawler task creation endpoint (api_add_crawler_task). Look for requests where a user attempts to attach a cookiejar UUID from another organization. Check if the system enforces ACL restrictions on cookiejar access during task creation.

Impact Analysis

If you are an authenticated user with crawler task creation privileges, an attacker could exploit this to access another organization's session data through your crawler tasks. This could lead to unauthorized access to sensitive information or systems belonging to the victim organization.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using the AIL Framework may face compliance breaches, legal penalties, and reputational damage due to potential data leaks.

Mitigation Strategies

Update the AIL Framework to the latest version where the authorization check for cookiejar UUIDs has been fixed to validate organizational boundaries and user roles. Ensure all authenticated users have the principle of least privilege and restrict crawler task creation permissions to authorized personnel only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100177. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart