Incorrect authorization in Computer Vision Annotation Tool (CVAT) - #VU162586
Published: November 9, 2026
Vulnerability identifier: #VU162586
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker with an organization maintainer role to gain owner permissions in a CVAT organization.
The vulnerability exists due to insufficient authorization checks when changing another member's role through CVAT's organization role management functionality. An authenticated remote attacker with an organization maintainer role can promote a second account they control within the same organization to owner, thereby obtaining owner privileges through that account.
Affected software
Computer Vision Annotation Tool (CVAT)
Remediation
Install security update from vendor's website.
Computer Vision Annotation Tool (CVAT) - update to 2.80.0