CVE-2026-125373 · Other
NO FIX YET · SEE WHAT TO DO
IETF Datatracker before 12.83.0 lets NomCom role holders reach other committees' records by supplying sequential primary keys. An attacker with that role can view confidential nominee identities and feedback, reclassify feedback, and change nominee email addresses.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only organisations running their own IETF Datatracker instance are described as exposed, and the flaw needs a NomCom role holder's account. The sources do not say which deployments are most at risk beyond that.
Not affected if already-on-12.83.0-or-later
Who cares ietf-datatracker, nomcom
12.83.0.12.83.0IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.