MEDIUM 5.3 NVD
CVE-2026-125373
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.
References
- https://github.com/ietf-tools/datatracker
- https://github.com/ietf-tools/datatracker/blob/3aa2f63af2b0198928e36db42203f55cfea53fbd/ie
- https://github.com/ietf-tools/datatracker/commit/f5bed82fee83d1dc28d89e15856fd329719ebda2
- https://github.com/ietf-tools/datatracker/releases/tag/12.83.0
- https://www.vulncheck.com/advisories/ietf-datatracker-before-12.83.0-cross-nomcom-authoriz
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.