{"id":"CVE-2026-125373","kind":"vulnerability","aliases":["CVE-2026-125373"],"related":[],"title":"IETF Datatracker: NomCom role holders can read other committees' nominee records","description":"IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.","summary":"IETF Datatracker before 12.83.0 lets NomCom role holders reach other committees' records by supplying sequential primary keys. An attacker with that role can view confidential nominee identities and feedback, reclassify feedback, and change nominee email addresses.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ietf-datatracker","nomcom","other"],"not_affected_if":["already-on-12.83.0-or-later"],"how_to_check":"- Check the installed IETF Datatracker version against `12.83.0`.","fix":"- IETF Datatracker: `12.83.0`","status":"open","published_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:30+00:00","updated_at":"2026-11-10T00:30:30+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T00:30:30Z","model":"claude-haiku-5-5","output":{"fix":"- IETF Datatracker: `12.83.0`","reach":"network","title":"IETF Datatracker: NomCom role holders can read other committees' nominee records","impact":"medium","summary":"IETF Datatracker before 12.83.0 lets NomCom role holders reach other committees' records by supplying sequential primary keys. An attacker with that role can view confidential nominee identities and feedback, reclassify feedback, and change nominee email addresses.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ietf-datatracker","nomcom"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Confidential nominee identities readable and nominee emails changed by role holders","analyst_note":"","how_to_check":"- Check the installed IETF Datatracker version against `12.83.0`.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["already-on-12.83.0-or-later"],"who_is_affected":"Only organisations running their own IETF Datatracker instance are described as exposed, and the flaw needs a NomCom role holder's account. The sources do not say which deployments are most at risk beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4638,"output_tokens":452,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125373':14A,17A '-2026':13A,16A '12.83.0':25B,61C 'abus':84C 'access':73C 'address':57B,108C 'allow':68C 'attack':40B,82C 'author':64C 'bypass':65C 'chang':54B,105C 'committe':9A,32B,75C 'confidenti':46B,99C 'contain':62C 'cve':12A,15A 'datatrack':2A,20B,23B,59C 'edit':95C 'email':56B,107C 'feedback':50B,52B,86C,89C,92C,103C 'holder':5A,29B,71C 'ident':48B,101C 'ietf':1A,19B,22B,58C 'ietf-datatrack':18B 'key':38B,81C 'let':26B 'nomcom':3A,21B,27B,69C 'nomine':10A,47B,55B,87C,96C,100C,106C 'primari':37B,80C 'reach':30B 'read':7A 'reclassifi':51B,102C 'record':11A,33B,76C 'role':4A,28B,43B,70C 'sequenti':36B,79C 'suppli':35B,78C 'topic':90C 'unrel':93C 'view':45B,85C,88C,91C,98C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Only organisations running their own IETF Datatracker instance are described as exposed, and the flaw needs a NomCom role holder's account. The sources do not say which deployments are most at risk beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ietfdatatracker","medium","nomcom","other"],"campaign_type":null,"search_a":"'-125373':14A,17A '-2026':13A,16A 'committe':9A 'cve':12A,15A 'datatrack':2A 'holder':5A 'ietf':1A 'nomcom':3A 'nomine':10A 'read':7A 'record':11A 'role':4A","search_b":"'12.83.0':25B 'address':57B 'attack':40B 'chang':54B 'committe':32B 'confidenti':46B 'datatrack':20B,23B 'email':56B 'feedback':50B,52B 'holder':29B 'ident':48B 'ietf':19B,22B 'ietf-datatrack':18B 'key':38B 'let':26B 'nomcom':21B,27B 'nomine':47B,55B 'primari':37B 'reach':30B 'reclassifi':51B 'record':33B 'role':28B,43B 'sequenti':36B 'suppli':35B 'view':45B","search_c":"'12.83.0':61C 'abus':84C 'access':73C 'address':108C 'allow':68C 'attack':82C 'author':64C 'bypass':65C 'chang':105C 'committe':75C 'confidenti':99C 'contain':62C 'datatrack':59C 'edit':95C 'email':107C 'feedback':86C,89C,92C,103C 'holder':71C 'ident':101C 'ietf':58C 'key':81C 'nomcom':69C 'nomine':87C,96C,100C,106C 'primari':80C 'reclassifi':102C 'record':76C 'role':70C 'sequenti':79C 'suppli':78C 'topic':90C 'unrel':93C 'view':85C,88C,91C,98C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125373","severity":null,"published_at":"2026-11-10T00:17:09+00:00","modified_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111524,"url":"https://github.com/ietf-tools/datatracker/commit/f5bed82fee83d1dc28d89e15856fd329719ebda2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111525,"url":"https://github.com/ietf-tools/datatracker/releases/tag/12.83.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111526,"url":"https://www.vulncheck.com/advisories/ietf-datatracker-before-12.83.0-cross-nomcom-authorization-bypass-via-nomcom-views","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}