---
id: "CVE-2026-125373"
page: "https://infrastack.ai/live/CVE-2026-125373"
kind: "vulnerability"
aliases: ["CVE-2026-125373"]
title: "IETF Datatracker: NomCom role holders can read other committees' nominee records"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ietf-datatracker", "nomcom", "other"]
not_affected_if: ["already-on-12.83.0-or-later"]
published_at: "2026-11-10T00:17:09+00:00"
first_seen_at: "2026-11-10T00:28:42+00:00"
updated_at: "2026-11-10T00:30:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125373", "first_seen_at": "2026-11-10T00:28:42+00:00"}]
exploit_sources: []
---

# IETF Datatracker: NomCom role holders can read other committees' nominee records

Link for people: https://infrastack.ai/live/CVE-2026-125373 (this .md is for agents)

IETF Datatracker before 12.83.0 lets NomCom role holders reach other committees' records by supplying sequential primary keys. An attacker with that role can view confidential nominee identities and feedback, reclassify feedback, and change nominee email addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IETF Datatracker version against `12.83.0`.

## Fix

- IETF Datatracker: `12.83.0`

## Timeline

- 2026-11-10T00:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125373

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ietf-datatracker-before-12.83.0-cross-nomcom-authorization-bypass-via-nomcom-views
- [fix] Patch: github.com https://github.com/ietf-tools/datatracker/commit/f5bed82fee83d1dc28d89e15856fd329719ebda2
- [fix] Release notes: github.com https://github.com/ietf-tools/datatracker/releases/tag/12.83.0

## From the sources

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_