Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-100903
ООО НПО Ритм GEOritm REST API obj-groups missing authentication
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N N L N N 5.5 .0046 37.5 —
AFFECTED
Product Versions Fixed
GEOritm 2.45.0 – 2.46
TIMELINE
Sep 27 Reserved by VulDB
Sep 28 EXPLOIT PUBLISHED — CVE-2026-100903 (ООО НПО Ритм GEOritm). Public exploit reference added.
Sep 28 Published (CNA: VulDB)
Oct 1 EXPLOIT PUBLISHED — CVE-2026-100903 (ООО НПО Ритм GEOritm). Public exploit reference added.
Description
A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| September 27, 2026 | Reserved | Reserved by VulDB |
| September 28, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-100903 (ООО НПО Ритм GEOritm). Public exploit reference added. |
| September 28, 2026 | Published | Published (CNA: VulDB) |
| October 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-100903 (ООО НПО Ритм GEOritm). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| ООО НПО Ритм | GEOritm | — | 2.45.0 | 2.46 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-100903 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
