Skip to main content

CVAT CVE-2026-73221

| EUVDEUVD-2026-56856 MEDIUM
Incorrect Authorization (CWE-863)
2026-08-11 GitHub_M
Authentication Bypass Cvat
5.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-accessible requiring only low-privilege Worker account; confidentiality limited to request metadata and integrity limited to canceling jobs, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 11, 2026 - 23:00 vuln.today
Analysis Generated
Aug 11, 2026 - 23:00 vuln.today
Patch available
Aug 11, 2026 - 19:04 EUVD

DescriptionCVE.org

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.

AnalysisAI

Broken object-level authorization in CVAT's lambda annotation API allows authenticated Worker-role users to exploit predictable task-based request IDs to read automatic annotation requests for tasks they are not permitted to access and to cancel annotation requests submitted by other users. All CVAT deployments running versions 2.17.0 through 2.71.x are affected per cpe:2.3:a:cvat-ai:cvat. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with Worker-role account
Delivery
Observe own task IDs to infer request ID pattern
Exploit
Enumerate predictable lambda request IDs for out-of-scope tasks
Execution
Call retrieve endpoint to read unauthorized annotation request metadata
Persist
Call destroy endpoint with enumerated IDs
Impact
Cancel other users' automatic annotation jobs
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an active CVAT account with at minimum the Worker role - unauthenticated access is not possible, as the CVSS 4.0 PR:L metric confirms. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) accurately represents the constrained blast radius: exploitation requires a valid Worker-role credential (PR:L), the confidentiality exposure is limited to lambda request metadata rather than annotation content (VC:L), and the integrity impact is limited to canceling others' annotation jobs (VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated CVAT user with the Worker role constructs or enumerates predictable task-based lambda request IDs - derived from task identifiers the Worker can observe from their own tasks - and issues GET requests to the lambda retrieve endpoint for IDs corresponding to tasks they have no legitimate access to, obtaining annotation request metadata. The attacker then issues DELETE requests to the destroy endpoint using those IDs to cancel in-flight automatic annotation jobs belonging to other teams, disrupting their annotation pipelines. …
Remediation Upgrade CVAT to version 2.72.0 or later, which resolves the authorization flaw as confirmed by the vendor release at https://github.com/cvat-ai/cvat/releases/tag/v2.72.0 and security advisory GHSA-m7p7-6w4m-886p. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cvat

View all
CVE-2026-65986 HIGH
8.5 Aug 04

Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a

CVE-2026-44369 HIGH
8.5 May 13

Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authentica
CVE-2026-73220 HIGH
8.5 Aug 20

Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide ed
CVE-2026-47682 HIGH
7.1 Aug 04

Path traversal in CVAT versions 1.6.0 through 2.64.0 enables an authenticated, low-privileged attacker with write access
CVE-2026-58373 MEDIUM
5.3 Jun 30

Cross-organization report enumeration in CVAT before 2.69.0 exposes the existence of quality reports belonging to other

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-73221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy