{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/georitm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-100903"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GEOritm (\u003c= 2.45.1)"],"_cs_severities":["high"],"_cs_tags":["information-disclosure","api-vulnerability","georitm"],"_cs_type":"advisory","_cs_vendors":["ООО НПО Ритм"],"content_html":"\u003cp\u003eGEOritm versions \u0026lt;= 2.45.1 contain a missing authentication vulnerability (CVE-2026-100903) in the POST /restapi/objects/obj-groups endpoint. Exploitation allows remote, unauthenticated attackers to query the API using an 'objectId' parameter to return organizational data, regional associations, and potentially the name and initials of the responsible driver. Enumeration of these identifiers enables deanonymization of monitored fleet objects.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized information disclosure of fleet telemetry and personally identifiable information (PII). Attackers can systematically enumerate monitored objects to map entire fleets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict network access to the GEOritm REST API to trusted internal management segments.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous, high-volume POST requests to /restapi/objects/obj-groups originating from untrusted IP addresses.\u003c/li\u003e\n\u003cli\u003eMonitor for the deployment of enumeration scripts similar to the publicly released 'ritm_park_enum.sh'.\u003c/li\u003e\n\u003cli\u003eVerify current version of GEOritm and coordinate with the vendor (ООО НПО Ритм) for remediation paths beyond version 2.45.1.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:37:33Z","date_published":"2026-10-23T16:37:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-georitm-auth-bypass/","summary":"An authentication bypass vulnerability in the GEOritm REST API allows unauthenticated remote attackers to enumerate fleet assets and retrieve sensitive personal data via the /restapi/objects/obj-groups endpoint.","title":"GEOritm: Unauthenticated information disclosure via REST API (CVE-2026-100903)","url":"https://feed.craftedsignal.io/briefs/2026-10-georitm-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Georitm","version":"https://jsonfeed.org/version/1.1"}