EUVD-2026-65060
GHSA-f3mm-hmc7-j4qg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because any authenticated account satisfies the only access check; S:U because both vulnerable API and impacted data reside within Label Studio; AV:N/AC:L/UI:N given trivial network exploitation with sequential IDs.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.
AnalysisAI
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the same Label Studio instance as the target organization (PR:L - any user tier suffices, including the lowest-privilege registered account). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is an accurate representation of the vulnerability's mechanics: network-accessible, no complexity, low privilege (any authenticated account), and full triad impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a valid authenticated account in Organization A on a shared Label Studio instance iterates integer values in GET requests to /api/annotations/<id>/, receiving annotation data belonging to Organization B without any access error. The attacker then issues PATCH requests to overwrite annotation labels - corrupting the training data pipeline - and DELETE requests to destroy annotations permanently, with the API accepting all operations because the only enforced check is session authentication. |
| Remediation | No vendor-released patch version has been confirmed from the available data - upstream fix availability should be monitored via the GitHub issue at https://github.com/HumanSignal/label-studio/issues/9796 and the VulnCheck advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Label Studio audit logs for annotation API queries with sequential ID patterns to identify compromised datasets and affected tenants. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Label Studio
View allLabel Studio is an open source data labeling tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely expl
Label Studio is a multi-type data labeling and annotation tool with standardized output format. Rated high severity (CVS
Label Studio is an open source data labeling tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploi
Label Studio is a multi-type data labeling and annotation tool. Rated high severity (CVSS 7.6), this vulnerability is re
A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.
Label Studio is an open source data labeling tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitize
Stored XSS in Label Studio's custom_hotkeys feature allows authenticated attackers to inject malicious JavaScript that e
Server-side request forgery in HumanSignal Label Studio through 1.24.0.dev0 allows authenticated users to direct the ser
Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote w
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today