Label Studio CVE-2026-85211

Exploitation requires a valid Label Studio account with at least the ability to create or belong to an organization (PR:L). The vulnerability is specific to multi-tenant deployments where multiple distinct organizations share a single Label Studio instance - single-tenant self-hosted deployments are not exposed to cross-tenant data leakage. The attacker must know or enumerate valid cloud storage URIs (e.g., S3 paths) belonging to other tenants; no additional authentication or elevated privilege beyond account registration is required. Exploitation is limited to confidentiality impact (read-only access to cloud storage objects); there is no integrity or availability impact. Deployments using local file storage rather than cloud backends may have reduced or no exposure depending on how proxy_api.py resolves local URIs.

The CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H reflects the real risk accurately: the attack is entirely network-reachable, requires only low-privilege access (any registered user), involves no user interaction, and causes high confidentiality impact both within the attacker's tenant context and across the subsequent-system boundary into other tenants' cloud storage. The scope-change (SC:H) correctly captures the cross-tenant impact. EPSS data is not provided, and there is no KEV listing or public POC. The practical risk is highest for organizations running Label Studio as a shared multi-tenant service (e.g., SaaS deployments or shared internal annotation platforms); single-tenant self-hosted deployments face no cross-tenant exposure. The attack is trivially automatable: an attacker who registers an account simply iterates or guesses cloud storage paths. The 'Authentication Bypass' tag in the input is a mislabel - exploitation requires authentication, making this an authorization bypass (IDOR), not an authentication bypass.

An attacker registers a legitimate account on a shared Label Studio instance and creates their own organization. They then submit crafted requests to the proxy_api.py presign or stream endpoints, supplying cloud storage URIs (e.g., S3 bucket paths) belonging to a different organization on the same instance. Because no organization filter is applied during URI resolution, the server returns presigned URLs or streams the content using its own cloud credentials, exposing the target organization's training data, labeled datasets, or source media.