CVE-2026-125373
IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.
| CWE | CWE-639 |
| Vendor | ietf-tools |
| Product | datatracker |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for ietf-tools datatracker
Be the first to know when new medium vulnerabilities affecting ietf-tools datatracker are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
ietf-tools / datatracker
0 < 12.83.0
References
github.com: https://github.com/ietf-tools/datatracker/commit/f5bed82fee83d1dc28d89e15856fd329719ebda2 github.com: https://github.com/ietf-tools/datatracker github.com: https://github.com/ietf-tools/datatracker/blob/3aa2f63af2b0198928e36db42203f55cfea53fbd/ietf/nomcom/views.py#L1001-L1010 github.com: https://github.com/ietf-tools/datatracker/releases/tag/12.83.0 vulncheck.com: https://www.vulncheck.com/advisories/ietf-datatracker-before-12.83.0-cross-nomcom-authorization-bypass-via-nomcom-views
Credits
hieuPenguinnn Robert Sparks