Authorization Bypass Vulnerability in IETF Datatracker Products

CVE-2026-125373

What is CVE-2026-125373?

The IETF Datatracker prior to version 12.83.0 has a vulnerable authorization bypass that enables NomCom role holders to gain unauthorized access to records from other committees. By manipulating sequential primary keys, an attacker can exploit functions such as view_feedback_nominee, view_feedback_topic, view_feedback_unrelated, and edit_nominee. This vulnerability potentially exposes sensitive nominee identities, allows the reclassification of feedback, and enables changes to nominee email addresses, compromising the integrity and confidentiality of the data.

References