Label Studio CVE-2026-76073

Exploitation requires a valid authenticated session on the same Label Studio instance as the target organization (PR:L - any user tier suffices, including the lowest-privilege registered account). The vulnerability is present on any deployment where multiple organizations share a single Label Studio instance, which is the standard multi-tenant SaaS configuration and common for shared self-hosted enterprise deployments. No non-default configuration is required - the unscoped queryset is the default code path active on every installation. Exploitation is bounded by two factors: (1) the attacker must hold a valid login on the same instance as the victim organization, meaning fully isolated single-tenant deployments are not exposed; (2) annotation IDs must be reachable via the network, which they are by default given the AV:N vector. There is no required user interaction, no elevated privilege beyond basic login, and no complex attack precondition.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is an accurate representation of the vulnerability's mechanics: network-accessible, no complexity, low privilege (any authenticated account), and full triad impact. This is not a high-CVSS-but-low-real-risk case for multi-tenant deployments - the cross-organization data boundary failure is directly exploitable with standard HTTP requests and sequential ID iteration, requiring no tooling beyond curl. The sole meaningful barrier is PR:L (an authenticated session), which on shared SaaS or multi-tenant self-hosted instances is satisfied by any registered user in any tenant on the same deployment. Risk is substantially lower for single-organization isolated deployments, where cross-tenant access is impossible by topology even though the code flaw remains. No KEV listing and no confirmed POC reduce urgency compared to actively weaponized vulnerabilities, but the trivial exploitation conditions mean defenders should not treat 'no known POC' as a durable buffer. EPSS data is not present in the input; no inference is made.

An attacker holding a valid authenticated account in Organization A on a shared Label Studio instance iterates integer values in GET requests to /api/annotations/<id>/, receiving annotation data belonging to Organization B without any access error. The attacker then issues PATCH requests to overwrite annotation labels - corrupting the training data pipeline - and DELETE requests to destroy annotations permanently, with the API accepting all operations because the only enforced check is session authentication.