CVE-2026-100177 Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment

The AIL Framework crawler task creation API apiaddcrawlertask contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed and, if its access level was 0, compared...

CVE-2026-100177

The AIL Framework crawler contains an authorization flaw in the api_add_crawler_task API. The application fails to validate organizational boundaries or user roles when a user provides a cookiejar UUID for one-shot or scheduled crawler tasks. Specifically, if a cookiejar's access level is not 0, ...