Incorrect authorization in Computer Vision Annotation Tool (CVAT) - #VU162587
Published: November 9, 2026
Vulnerability identifier: #VU162587
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to obtain usernames, first names, and last names of any other user on a CVAT instance.
The vulnerability exists due to incorrect authorization in CVAT's organization context when accessing user information. An authenticated attacker can use organization membership or permission to create an organization to retrieve these details without interaction from the affected users.
Affected software
Computer Vision Annotation Tool (CVAT)
Remediation
Install security update from vendor's website.
Computer Vision Annotation Tool (CVAT) - update to 2.80.0