Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100903— ООО НПО Ритм GEOritm REST API obj-groups missing authentication

Quick assessment

Affected
ООО НПО Ритм GEOritm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ООО НПО Ритм GEOritm 2.45.1 及更早版本中发现了一个漏洞。该漏洞影响了 REST API 组件中 /restapi/objects/obj-groups 文件的某个未知部分。对参数 objectId 的此类操纵会导致身份验证缺失。该攻击可以远程发起，利用代码已公开，可能被恶意利用。升级至 2.46 版本可缓解此问题，建议尽快升级受影响的组件。 厂商确认如下：“2026 年 8 月，NPO Ritm 收到了俄罗斯联邦技术出口管制局（FSTEC Russia）的正式漏洞通知。该漏洞注册标识

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100903

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ООО НПО Ритм GEOritm REST API obj-groups missing authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ООО НПО Ритм GEOritm 2.45.0 cpe:2.3:a:_:georitm:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-100903

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100903

请登录查看更多情报信息。

Other References for CVE-2026-100903 (5)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-100903

No comments yet

Leave a comment