The three notifications required by Article 14(2). Each draft needs a human approval. Your team then submits it on the single reporting platform, addressed to the CSIRT designated as coordinator and to ENISA, and records it here.
Draft for review by a responsible person. Not legal advice. Exercise: do not submit.
Art. 14(2)(a)
Early warning
SubmittedRecorded 22 Oct 2026, 14:28 UTC
DraftDone
Approved by humanDone
Recorded in drillCurrent
Manufacturer
GAP: manufacturer name and contact (project setting A14_MANUFACTURER)Source: not recorded
Product
ledgerline, versions <= 1.0.0Source: SBOM metadata of the detection pipeline
Actively exploited vulnerability
CVE-2022-23540 (GHSA-qwph-4952-7xr6): jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()Source: https://osv.dev/vulnerability/GHSA-qwph-4952-7xr6
Exploitation signal
DRILL, simulated: Exercise scenario: the security lead declares active exploitation of this vulnerability against Ledgerline share links. The CVE is real; it is not listed in the CISA KEV catalog, so the exploitation is simulated.Source: exercise scenario chain/drill/scenario.json
Time the manufacturer became aware (UTC)
2026-10-22T13:06:42.022ZSource: case issue https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43597174/article-14/-/work_items/1
Member States where the product is made available
GAP: Member States where the product is made available (project setting A14_MEMBER_STATES)Source: not recorded
Recorded in drill, nothing sent, 22 Oct 2026, 14:28 UTCPlatform reference: DRILL-REF-EW
Art. 14(2)(b)
Vulnerability notification
SubmittedRecorded 22 Oct 2026, 14:28 UTC
DraftDone
Approved by humanDone
Recorded in drillCurrent
Manufacturer
GAP: manufacturer name and contact (project setting A14_MANUFACTURER)Source: not recorded
General information about the product
ledgerline, versions <= 1.0.0Source: SBOM metadata of the detection pipeline
General nature of the exploit and of the vulnerability
In jsonwebtoken versions up to and including 8.5.1, jwt.verify() can accept a token with no signature (alg none) when no algorithms are specified and a falsy secret or key is passed, which bypasses signature validation (CVE-2022-23540, GHSA-qwph-4952-7xr6). In the exercise scenario an unsigned share token is accepted by jwt.verify() without an algorithm list, so anyone can forge a share link for any book on Ledgerline. The exploitation is simulated for this drill, and the CVE is not listed in CISA KEV (catalog version 2026.10.21).Source: proposed by ai-article-14-cra-report-gitlab-ai-hackathon, review required (https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43597174/article-14/-/merge_requests/8#note_4068596155)
Corrective or mitigating measures taken
Component jsonwebtoken upgraded from 8.5.1 to 9.0.0 in merge request https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43597174/article-14/-/merge_requests/9; merged 2026-10-22T13:35:06.919Z; deployed to production 2026-10-22T13:58:02.143Z (approved by Chinorab); released as v1.0.1Source: merge request, deployment and release records
Corrective or mitigating measures users can take
No user action is needed: Ledgerline is a hosted service and the fix is in production.Source: Chinorab, https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43597174/article-14/-/work_items/1#note_4068620242
Sensitivity of the notified information
GAP: sensitivity assessment by the security leadSource: not recorded
Recorded in drill, nothing sent, 22 Oct 2026, 14:28 UTCPlatform reference: DRILL-REF-NT
Art. 14(2)(c)
Final report
SubmittedRecorded 22 Oct 2026, 14:28 UTC
DraftDone
Approved by humanDone
Recorded in drillCurrent
Manufacturer
GAP: manufacturer name and contact (project setting A14_MANUFACTURER)Source: not recorded
Description of the vulnerability, including its severity and impact
Severity MODERATE, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L. jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() Impact: In Ledgerline 1.0.0, which contains jsonwebtoken 8.5.1, an attacker could forge a share link for any book by presenting an unsigned token that jwt.verify() accepts. The advisory rates the severity MODERATE (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L), with the highest rating on integrity. The facts record no other consequences. Since v1.0.1 is in production, the release notes state that unsigned and re-signed share tokens are refused.Source: https://osv.dev/vulnerability/GHSA-qwph-4952-7xr6; impact proposed by ai-article-14-cra-report-gitlab-ai-hackathon, review required
Information concerning any malicious actor
None. The exploitation is simulated for this exercise.Source: exercise scenario
Details about the security update or other corrective measures
ledgerline v1.0.1 in production since 2026-10-22T13:58:02.143Z; jsonwebtoken 9.0.0Source: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43597174/article-14/-/releases/v1.0.1
Recorded in drill, nothing sent, 22 Oct 2026, 14:28 UTCPlatform reference: DRILL-REF-FR