CVE-2026-125373— IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views

Quick assessment

Affected

ietf-tools datatracker

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

IETF Datatracker 在 12.83.0 版本之前存在一个权限绕过漏洞，该漏洞允许拥有 NomCom 角色的用户通过提供连续的主键来访问其他委员会的记录。攻击者可利用、、和等接口，查看机密提名人身份信息、重新分类反馈内容，以及更改提名人的电子邮件地址。

CVSS 5.4 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views

Source: CVE Program / CVE List V5

Vulnerability Description

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ietf-tools	datatracker	0 ~ 12.83.0	-

II. Public POCs for CVE-2026-125373

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125373

请登录查看更多情报信息。

Other References for CVE-2026-125373 (5)

https://github.com/ietf-tools/datatracker product
https://github.com/ietf-tools/datatracker/blob/3aa2f63af2b0198928e36db42203f55cfea53fbd/ietf/nomcom/views.py#L1001-L1010 technical-description
https://github.com/ietf-tools/datatracker/commit/f5bed82fee83d1dc28d89e15856fd329719ebda2 patch
https://github.com/ietf-tools/datatracker/releases/tag/12.83.0 release-notes
https://www.vulncheck.com/advisories/ietf-datatracker-before-12.83.0-cross-nomcom-authorization-bypass-via-nomcom-views third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-125373

IV. Related Vulnerabilities

Same weakness: CWE-639