SB2026110940 - Multiple vulnerabilities in Computer Vision Annotation Tool (CVAT)

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated remote attacker with an organization maintainer role to gain owner permissions in a CVAT organization.

The vulnerability exists due to insufficient authorization checks when changing another member's role through CVAT's organization role management functionality. An authenticated remote attacker with an organization maintainer role can promote a second account they control within the same organization to owner, thereby obtaining owner privileges through that account.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker to obtain usernames, first names, and last names of any other user on a CVAT instance.

The vulnerability exists due to incorrect authorization in CVAT's organization context when accessing user information. An authenticated attacker can use organization membership or permission to create an organization to retrieve these details without interaction from the affected users.

Remediation

Install update from vendor's website.

References

• https://github.com/cvat-ai/cvat/security/advisories/GHSA-92cv-2cwp-4gxh
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-7w7g-2854-hxx5