CVE-2026-100177 (GCVE-0-2026-100177)

Vulnerability from cvelistv5 – Published: 2026-09-25 13:35 – Updated: 2026-09-25 14:55
VLAI
Title
Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment
Summary
The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar's owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user's role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization's cookiejar by UUID and have the crawler use that organization's stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization's session data. The vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization's stored cookies and session data through the crawler infrastructure.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 14:55 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version CPE status
ail project ail framework Affected: unspecified , < 7.1 (semver)
guessed Create a notification for this product.
Credits
terrtia Jeroen Pinoy
GCVE extensions
AI involvement GCVE-BCP-05-X-01
Whole record AI-generated Not human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
Patch provenance GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-09-25 13:30
Model
qwen3.8:27b
Input
https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch 43e163a1b90d…
Confidence
medium
Commit Subject Patch SHA-256
3773ca36658c chg: [security] crawler, enforce cookiejar ACL when creating 43e163a1b90d…
Fix summary

The cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the 'view' action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing.

Patch summary

In bin/lib/crawlers.py: (1) is_global_url() now returns False for any scheme other than http/https (previously returned True for data/file schemes) and handles URLs lacking a netloc by prepending http://. (2) api_validate_global_urls() now rejects non-HTTP/HTTPS schemes with a 400 error before the local-IP filter check. (3) The Cookiejar class gains a get_creator() alias. (4) The CrawlerTask.create() method validates the URL scheme. (5) api_add_crawler_task() replaces the inline level-0 user-ID comparison with a call to api_check_cookiejar_access_acl(cookiejar_uuid, user_org, user_id, user_role, action='view') and accepts a new user_role parameter. (6) api_add_crawler_capture() now calls api_validate_global_urls(). In var/www/blueprints/api_rest.py and crawler_splash.py: user_role is extracted from the authenticated session and passed to api_add_crawler_task().

CVSS rationale

The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) since the attacker only needs to substitute a known or guessed cookiejar UUID in an API request. No attack target manipulation is required (AT:N). An authenticated user with crawler task creation privileges is needed (PR:L). No user interaction is required (UI:N). The vulnerable component itself does not lose confidentiality, integrity, or availability (VC:N, VI:N, VA:N). However, the subsequent impact is high on confidentiality (SC:H) because the attacker gains access to another organization's stored cookies and session tokens via the crawler, which could be used to impersonate the victim on target sites. No subsequent integrity or availability impact is evident (SI:N, SA:N).

Weakness rationale
  • CWE-639 The cookiejar UUID is a user-supplied identifier (key) that was not properly validated against the requesting user's organization and role. The old code only compared user IDs when level was 0 and skipped the check entirely otherwise, allowing cross-organization access to another user's cookiejar.
  • CWE-20 The URL scheme validation was incorrect: data: and file: schemes were treated as valid global URLs, and the scheme check was skipped when the local-IP filter was disabled. The fix enforces that only http and https schemes are accepted unconditionally.
Attack pattern rationale
  • CAPEC-1 The attacker tampers with the cookiejar UUID parameter in the crawler task creation API request to reference a resource (cookiejar) belonging to another organization. The system failed to validate that the referenced object was accessible to the requesting user's organization. This is the closest CAPEC pattern to an IDOR-style parameter substitution; no CAPEC specifically named 'Insecure Direct Object Reference' exists, so CAPEC-1 (modifying a request parameter to access unauthorized resources) is the best available match.
Assumptions to verify
  • The api_check_cookiejar_access_acl() function is assumed to correctly enforce organization, user, and role-based access control; its implementation is not included in this patch.
  • The cookiejar UUID is assumed to be guessable or discoverable by an authenticated user (e.g., via enumeration or information leakage); if UUIDs are truly random and unguessable, exploitability is reduced but the authorization flaw remains.
  • The CVSS assumes the primary security impact is subsequent confidentiality (access to another org's cookies/sessions) rather than direct compromise of the Ail Framework itself.
  • The CAPEC-1 mapping is the closest available pattern for an IDOR/parameter-substitution attack; no CAPEC specifically covers insecure direct object reference, so this mapping carries some uncertainty.
  • The affected version boundary is inferred from the tag v7.1 (26 commits after the fix commit), suggesting the fix landed before the v7.1 release; exact affected version range is not confirmed.
  • The URL scheme validation fix (rejecting data:/file: schemes) is treated as a secondary hardening change within the same patch set rather than a separate vulnerability.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 4 9 medium 6
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-100177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T14:55:38.429027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T14:55:51.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "bin/lib/crawlers.py",
            "var/www/blueprints/api_rest.py",
            "var/www/blueprints/crawler_splash.py"
          ],
          "product": "ail framework",
          "programFiles": [
            "bin/lib/crawlers.py",
            "var/www/blueprints/api_rest.py",
            "var/www/blueprints/crawler_splash.py"
          ],
          "repo": "https://github.com/ail-project/ail-framework",
          "vendor": "ail project",
          "versions": [
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "terrtia"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar\u0027s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user\u0027s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization\u0027s cookiejar by UUID and have the crawler use that organization\u0027s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization\u0027s session data.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization\u0027s stored cookies and session data through the crawler infrastructure.\u003c/p\u003e"
            }
          ],
          "value": "The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar\u0027s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user\u0027s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization\u0027s cookiejar by UUID and have the crawler use that organization\u0027s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization\u0027s session data.\n\n\nThe vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization\u0027s stored cookies and session data through the crawler infrastructure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Tamper with URLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T13:35:50.465Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the \u0027view\u0027 action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing.\u003c/p\u003e"
            }
          ],
          "value": "The cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the \u0027view\u0027 action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing."
        }
      ],
      "title": "Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The api_check_cookiejar_access_acl() function is assumed to correctly enforce organization, user, and role-based access control; its implementation is not included in this patch.",
                  "The cookiejar UUID is assumed to be guessable or discoverable by an authenticated user (e.g., via enumeration or information leakage); if UUIDs are truly random and unguessable, exploitability is reduced but the authorization flaw remains.",
                  "The CVSS assumes the primary security impact is subsequent confidentiality (access to another org\u0027s cookies/sessions) rather than direct compromise of the Ail Framework itself.",
                  "The CAPEC-1 mapping is the closest available pattern for an IDOR/parameter-substitution attack; no CAPEC specifically covers insecure direct object reference, so this mapping carries some uncertainty.",
                  "The affected version boundary is inferred from the tag v7.1 (26 commits after the fix commit), suggesting the fix landed before the v7.1 release; exact affected version range is not confirmed.",
                  "The URL scheme validation fix (rejecting data:/file: schemes) is treated as a secondary hardening change within the same patch set rather than a separate vulnerability."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-1",
                    "rationale": "The attacker tampers with the cookiejar UUID parameter in the crawler task creation API request to reference a resource (cookiejar) belonging to another organization. The system failed to validate that the referenced object was accessible to the requesting user\u0027s organization. This is the closest CAPEC pattern to an IDOR-style parameter substitution; no CAPEC specifically named \u0027Insecure Direct Object Reference\u0027 exists, so CAPEC-1 (modifying a request parameter to access unauthorized resources) is the best available match."
                  }
                ],
                "commit": "3773ca36658c57ce592aebe74e27c855eb64f58a",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "terrtia"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) since the attacker only needs to substitute a known or guessed cookiejar UUID in an API request. No attack target manipulation is required (AT:N). An authenticated user with crawler task creation privileges is needed (PR:L). No user interaction is required (UI:N). The vulnerable component itself does not lose confidentiality, integrity, or availability (VC:N, VI:N, VA:N). However, the subsequent impact is high on confidentiality (SC:H) because the attacker gains access to another organization\u0027s stored cookies and session tokens via the crawler, which could be used to impersonate the victim on target sites. No subsequent integrity or availability impact is evident (SI:N, SA:N).",
                "fixSummary": "The cookiejar attachment path in api_add_crawler_task is now validated through the existing api_check_cookiejar_access_acl() function, which enforces organization, user, and role-based access control for the \u0027view\u0027 action on the referenced cookiejar. The user_role parameter is propagated from the API and UI entry points (api_rest.py, crawler_splash.py) into the ACL check. Separately, URL scheme validation is enforced unconditionally: only http and https schemes are accepted, and non-conforming URLs are rejected with a 400 error before any further processing.",
                "generatedAt": "2026-09-25T13:30:48.386437Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "43e163a1b90d5926293d5dbd7982d46241f08d7a9d2cb0edf86c963f794afac5",
                "patchSummary": "In bin/lib/crawlers.py: (1) is_global_url() now returns False for any scheme other than http/https (previously returned True for data/file schemes) and handles URLs lacking a netloc by prepending http://. (2) api_validate_global_urls() now rejects non-HTTP/HTTPS schemes with a 400 error before the local-IP filter check. (3) The Cookiejar class gains a get_creator() alias. (4) The CrawlerTask.create() method validates the URL scheme. (5) api_add_crawler_task() replaces the inline level-0 user-ID comparison with a call to api_check_cookiejar_access_acl(cookiejar_uuid, user_org, user_id, user_role, action=\u0027view\u0027) and accepts a new user_role parameter. (6) api_add_crawler_capture() now calls api_validate_global_urls(). In var/www/blueprints/api_rest.py and crawler_splash.py: user_role is extracted from the authenticated session and passed to api_add_crawler_task().",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "3773ca36658c57ce592aebe74e27c855eb64f58a",
                    "patchSha256": "43e163a1b90d5926293d5dbd7982d46241f08d7a9d2cb0edf86c963f794afac5",
                    "source": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch",
                    "sourceUrl": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch",
                    "subject": "chg: [security] crawler, enforce cookiejar ACL when creating"
                  }
                ],
                "source": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a.patch",
                "subject": "chg: [security] crawler, enforce cookiejar ACL when creating",
                "tagVersionBoundary": {
                  "commits_after_fix": 26,
                  "repository": "https://github.com/ail-project/ail-framework",
                  "tag": "v7.1",
                  "version": "7.1",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-639",
                    "rationale": "The cookiejar UUID is a user-supplied identifier (key) that was not properly validated against the requesting user\u0027s organization and role. The old code only compared user IDs when level was 0 and skipped the check entirely otherwise, allowing cross-organization access to another user\u0027s cookiejar."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The URL scheme validation was incorrect: data: and file: schemes were treated as valid global URLs, and the scheme check was skipped when the local-IP filter was disabled. The fix enforces that only http and https schemes are accepted unconditionally."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20183"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-100177",
    "datePublished": "2026-09-25T13:35:50.465Z",
    "dateReserved": "2026-09-25T13:35:37.184Z",
    "dateUpdated": "2026-09-25T14:55:51.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-100177",
      "date": "2026-09-26",
      "epss": "0.00341",
      "percentile": "0.25048"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "modules": [
                  "bin/lib/crawlers.py",
                  "var/www/blueprints/api_rest.py",
                  "var/www/blueprints/crawler_splash.py"
                ],
                "product": "ail framework",
                "programFiles": [
                  "bin/lib/crawlers.py",
                  "var/www/blueprints/api_rest.py",
                  "var/www/blueprints/crawler_splash.py"
                ],
                "repo": "https://github.com/ail-project/ail-framework",
                "vendor": "ail project",
                "versions": [
                  {
                    "lessThan": "7.1",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared the cookiejar\u0027s owning user ID to the requesting user ID. It did not validate organizational boundaries, did not account for the requesting user\u0027s role. When the cookiejar level was not 0, no access check was performed at all. An authenticated user could therefore reference another organization\u0027s cookiejar by UUID and have the crawler use that organization\u0027s stored cookies (session tokens, authentication credentials) when performing web crawls, effectively leaking or exfiltrating the victim organization\u0027s session data.\n\n\nThe vulnerability requires an authenticated user with the ability to create crawler tasks. The attacker must know or guess a valid cookiejar UUID belonging to another organization. The impact is unauthorized access to another organization\u0027s stored cookies and session data through the crawler infrastructure."
          }
        ],
        "id": "CVE-2026-100177",
        "lastModified": "2026-09-25T15:17:52.523",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-100177",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T14:55:38.429027Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-25T14:17:17.223",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/ail-project/ail-framework/commit/3773ca36658c57ce592aebe74e27c855eb64f58a"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.