Is there a patch available for EUVD-2026-40361?

Yes, a patch is available for EUVD-2026-40361. Update the affected software to the latest version immediately.

CVAT EUVD-2026-40361

Q: What is the CVSS score of EUVD-2026-40361?

EUVD-2026-40361 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-58373 MEDIUM

Missing Authorization (CWE-862)

2026-06-30 VulnCheck

GHSA-7fxw-w85g-2jg3

Authentication Bypass Cvat Cvat Ai

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable API requires authenticated session (PR:L); only report existence disclosed, no content or integrity impact (C:L, I:N, A:N); no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 17:24 vuln.today

CVSS changed

Jun 30, 2026 - 17:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

DescriptionCVE.org

CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.

AnalysisAI

Cross-organization report enumeration in CVAT before 2.69.0 exposes the existence of quality reports belonging to other organizations to any authenticated user. The vulnerability stems from a missing authorization gate in QualityReportViewSet.get_queryset, where the parent_id query parameter is processed without invoking check_object_permissions, allowing cross-tenant enumeration via differential HTTP response analysis. No public exploit or CISA KEV listing exists, but the attack is trivially automatable by any authenticated user in a multi-organization CVAT deployment.

Technical ContextAI

CVAT (cpe:2.3:a:cvat-ai:cvat:*:*:*:*:*:*:*:*) is an open-source computer vision annotation platform developed by cvat-ai. The quality reports subsystem exposes a REST API endpoint that accepts a parent_id query parameter to filter reports. CWE-862 (Missing Authorization) applies: Django REST Framework viewsets are expected to call check_object_permissions on resource lookups, but QualityReportViewSet.get_queryset omits this call for the parent_id filter path. As a result, the ORM query executes against any provided parent_id - including those belonging to other organizations - and the differing error responses (HTTP 500 for an existing-but-forbidden report, HTTP 404 for a non-existent one) function as a side-channel oracle. The root cause is an incomplete authorization implementation rather than a broken one: object-level permissions exist but are not uniformly enforced across all query entry points.

RemediationAI

Upgrade CVAT to version 2.69.0, which contains the fix introduced via commit 27953f19d2265f8b495369f816730a7452db791b (PR #10807, https://github.com/cvat-ai/cvat/pull/10807). The patch adds the missing check_object_permissions call for the parent_id query parameter path. If immediate upgrade is not feasible, operators running multi-organization deployments should consider restricting API access to the quality reports endpoint at the network or reverse-proxy layer - for example, blocking or rate-limiting requests to /api/quality/reports with a parent_id parameter from users outside a designated administrator role - though this carries a trade-off of degraded legitimate functionality. Complete remediation requires the code-level fix in 2.69.0; network controls alone do not close the authorization gap.