Missing Authentication in ООО НПО Ритм GEOritm REST API
CVE-2026-100903

6.9MEDIUM

Key Information:

Vendor: Ооо Нпо Ритм
Status: Georitm
Vendor: CVE Published:; 28 September 2026

🔔 Create Ооо Нпо Ритм Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-100903?

A missing authentication vulnerability has been identified in the GEOritm product by ООО НПО Ритм, affecting the REST API component related to obj-groups. The flaw allows remote attackers to manipulate the objectId argument, potentially leading to unauthorized access. Publicly available exploit code has been detected, prompting immediate action. Users are strongly advised to upgrade to version 2.46, which includes vital security fixes to address this issue, confirmed by the vendor following a notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia).

Affected Version(s)

GEOritm 2.45.0

GEOritm 2.45.1

GEOritm 2.46

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-100903 - Proof of Concept