EUVD-2026-26817Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNetwork reconnaissance
-
DeliveryIdentify valid DatasetId values
-
ExploitCraft API request with target DatasetId
-
ExecutionSend unauthenticated HTTP request to Dataset API
-
PersistAPI processes request without authentication check
-
ImpactAttacker reads or modifies dataset contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Remote unauthenticated exploitation against COCO Annotator instances with the Dataset API endpoint (backend/webserver/api/datasets.py) exposed and accessible over the network. The vulnerability requires knowledge of valid dataset identifiers (DatasetIds) belonging to other users or projects, but no special configuration or non-default settings are required-the authorization bypass exists in the default API implementation. The attack is possible against versions 0.11.1 and earlier with no version-specific configuration prerequisites. Exploitation is limited to remote network access scenarios; local exploitation is not applicable. The vulnerability affects the integrity and confidentiality of datasets but does not provide code execution or system-level access. |
| Impact | CVSS 5.5 (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-accessible remote exploitation requiring no authentication or user interaction, with moderate impact to data integrity and confidentiality (VI:L/VA:L). The CVSS:4.0 vector with E:P (Exploit Proof-of-Concept) confirms public availability of working exploit code. Risk is elevated by: (1) confirmed public exploit availability reducing barrier to exploitation, (2) no authentication required enabling opportunistic attacks, (3) vendor non-response leaving no patched version available, and (4) the nature of COCO Annotator as a collaborative dataset tool means datasets often contain sensitive training data or labeled information valuable for model development. Real-world risk depends on deployment context: isolated research environments face lower risk than cloud-hosted multi-tenant instances serving external users. The moderate CVSS score reflects limited scope (not full system compromise) but the integrity and confidentiality impacts directly compromise data governance. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a COCO Annotator instance accessible over the network and observes valid dataset identifiers through reconnaissance (e.g., error messages, prior public access). The attacker crafts HTTP requests to the Dataset API endpoint with modified DatasetId values corresponding to datasets belonging to other users or projects, without providing authentication credentials. The vulnerable API endpoint accepts these requests and returns or allows modification of dataset metadata and annotations, enabling the attacker to read sensitive training data or corrupt annotations used for model training. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 03, 2026
Authorization bypass in jsbroks COCO Annotator up to version 0.11.1 allows remote unauthenticated attackers to modify dataset parameters via manipulation of the DatasetId argument in the Dataset API endpoint backend/webserver/api/datasets.py, enabling unauthorized access to and modification of annotation datasets. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications.
RemediationAI
No vendor-released patch identified at time of analysis due to vendor non-response to disclosure. Immediate remediation options include: (1) Upgrade from COCO Annotator or discontinue use pending vendor response (recommended if security-critical); (2) Implement API gateway authentication and authorization controls that enforce per-user dataset access restrictions independent of client-supplied DatasetId parameters-validate that the authenticated user has explicit permission to access each dataset before processing the request; (3) Network segmentation: restrict COCO Annotator API access to trusted internal networks only, blocking external and untrusted client access via firewall rules; (4) Add input validation and parameterized access control in backend code (if modifying source) to check user credentials and dataset ownership before returning or modifying dataset objects, ensuring DatasetId alone does not grant access; (5) Implement API request logging and alerting on suspicious DatasetId patterns or cross-user access attempts to detect exploitation attempts. Network restriction is the most effective immediate compensating control but limits usability for distributed teams.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Dataset API component of COCO Annotator, a collaborative image annotation tool. The affected file backend/webserver/api/datasets.py handles dataset management operations through REST API endpoints. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that the application uses user-supplied input (DatasetId parameter) to determine access control decisions without proper validation of the requester's permissions. The vulnerability suggests the API endpoint trusts client-supplied dataset identifiers to validate ownership or authorization, allowing attackers to reference and manipulate datasets belonging to other users or projects by simply modifying the DatasetId value in their requests.
Know when Coco Annotator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Coco Annotator
View allA vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. Rated medium severity
Coco Annotator versions up to 0.11.1. is affected by improper resource shutdown or release (CVSS 5.3).
Coco Annotator through version 0.11.1 contains an authorization bypass in the Delete Category Handler endpoint (/api/und
Path traversal in jsbroks COCO Annotator up to version 0.11.1 allows authenticated remote attackers to access arbitrary
Exploit-DB