Incorrect authorization in Computer Vision Annotation Tool (CVAT) - #VU162588
Published: November 9, 2026
Vulnerability identifier: #VU162588
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged former organization member to retain unauthorized access to certain organization tasks and jobs.
The vulnerability exists due to incorrect authorization in CVAT that preserves owner or assignee access after organization membership is revoked. A low-privileged former organization member can use known or enumerated IDs to perform automatic annotation on owned or assigned work, or view media and modify annotations on assigned jobs when holding only the Worker global role.
Affected software
Computer Vision Annotation Tool (CVAT)
Remediation
Install security update from vendor's website.
Computer Vision Annotation Tool (CVAT) - update to 2.82.0