TI-2026-65041 Aliases CVE-2026-100903 GHSA-g456-7977-c699

ООО НПО Ритм GEOritm REST API obj-groups missing authentication

HIGH 70CWE-287Published 2026-09-28 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00562 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed GEOritm (ООО НПО Ритм): 2.46

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ООО НПО Ритм	GEOritm	2.45.0; 2.45.1	2.46	Patch available	CNA

GEOritm VendorООО НПО Ритм Affected 2.45.0; 2.45.1 Fixed in 2.46 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:_:georitm::::::::	—	—	—

cpe:2.3:a:_:georitm:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA GEOritm (ООО НПО Ритм) Fixed in 2.46

Timeline

2026-10-02 Threatist record created from CVE-2026-100903
2026-10-03 Alias added: GHSA-g456-7977-c699

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences