Skip to content
Threat Feed
Subscribe
high advisory

GEOritm: Unauthenticated information disclosure via REST API (CVE-2026-100903)

An authentication bypass vulnerability in the GEOritm REST API allows unauthenticated remote attackers to enumerate fleet assets and retrieve sensitive personal data via the /restapi/objects/obj-groups endpoint.

CVE search metadata

CVE search record: CVE-2026-100903. Severity: medium. CVSS: 5.3. EPSS: 0.46%. KEV: no. Product: GEOritm (<= 2.45.1). Brief: GEOritm: Unauthenticated information disclosure via REST API (CVE-2026-100903). Brief link: https://feed.craftedsignal.io/briefs/2026-10-georitm-auth-bypass/

Triage facts

Revision 1
Applicability
GEOritm (<= 2.45.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 23, 16:37 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

GEOritm versions <= 2.45.1 contain a missing authentication vulnerability (CVE-2026-100903) in the POST /restapi/objects/obj-groups endpoint. Exploitation allows remote, unauthenticated attackers to query the API using an 'objectId' parameter to return organizational data, regional associations, and potentially the name and initials of the responsible driver. Enumeration of these identifiers enables deanonymization of monitored fleet objects.

Impact

Successful exploitation leads to unauthorized information disclosure of fleet telemetry and personally identifiable information (PII). Attackers can systematically enumerate monitored objects to map entire fleets.

Recommendation

  • Restrict network access to the GEOritm REST API to trusted internal management segments.
  • Review web server access logs for anomalous, high-volume POST requests to /restapi/objects/obj-groups originating from untrusted IP addresses.
  • Monitor for the deployment of enumeration scripts similar to the publicly released 'ritm_park_enum.sh'.
  • Verify current version of GEOritm and coordinate with the vendor (ООО НПО Ритм) for remediation paths beyond version 2.45.1.

Immediate actions

Deploy Sigma rule for /restapi/objects/obj-groups API monitoring

Detection Engineering 24h

Threat Hunt

Search web server logs for high-frequency POST requests to /restapi/objects/obj-groups

T1592 high high confidence hunt now

Data: Web server access logs

Mitigations

Implement WAF or network-level access control list (ACL) restriction for /restapi/objects/obj-groups

immediate IT Operations

CVE-2026-100903

Detection coverage 1

Detect CVE-2026-100903 Exploitation Attempt

high

Detects unauthenticated POST requests to the GEOritm /restapi/objects/obj-groups endpoint.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →