Insufficient Authorization in AIL Framework Crawler Task Creation API

CVE-2026-100177

What is CVE-2026-100177?

The AIL Framework's crawler task creation API has a design flaw that permits authenticated users to create crawler tasks linked to another organization's cookiejar by exploiting insufficient authorization checks. This vulnerability arises from the API's neglect to verify the user's role and organizational boundaries when the cookiejar's access level is not set to zero. Consequently, an authenticated attacker with knowledge of a valid cookiejar UUID can leverage this flaw, gaining unauthorized access to another organization's stored cookies and session data, which may include sensitive session tokens and authentication credentials. The risk is significant as it allows potential data exfiltration during web crawls.

References