SB2026110941 - Incorrect authorization in Computer Vision Annotation Tool (CVAT)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110941

SB2026110941 - Incorrect authorization in Computer Vision Annotation Tool (CVAT)

Published: November 9, 2026

Security Bulletin ID SB2026110941
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged former organization member to retain unauthorized access to certain organization tasks and jobs.

The vulnerability exists due to incorrect authorization in CVAT that preserves owner or assignee access after organization membership is revoked. A low-privileged former organization member can use known or enumerated IDs to perform automatic annotation on owned or assigned work, or view media and modify annotations on assigned jobs when holding only the Worker global role.


Remediation

Install update from vendor's website.

References