Auto Labeling Pipeline Module To Annotate A Document Automatically
Monthly
Improper access controls in Doccano's Bulk-Delete Endpoint allow low-privileged authenticated users to delete category type labels across projects beyond their authorized scope, affecting all versions through 1.8.5. The vulnerability resides in the LabelList function at the /v1/projects/1/category-types REST API endpoint, where per-project authorization is not enforced during bulk-delete operations. A publicly available proof-of-concept exploit exists, and no vendor patch has been issued following disclosure; the vendor was unresponsive to coordinated disclosure.
Improper access control in Doccano's Project Example Detail endpoint allows authenticated low-privilege users to access, modify, or otherwise interact with project annotation data beyond their authorization scope. Versions up to 1.8.5 of both the Open Source Annotation Tools and Auto Labeling Pipeline Module components are confirmed affected. A publicly available proof-of-concept exploit exists; no vendor patch has been released and the vendor did not respond to responsible disclosure, leaving deployments exposed with no official remediation path.
Improper access controls in Doccano's Bulk-Delete Endpoint allow low-privileged authenticated users to delete category type labels across projects beyond their authorized scope, affecting all versions through 1.8.5. The vulnerability resides in the LabelList function at the /v1/projects/1/category-types REST API endpoint, where per-project authorization is not enforced during bulk-delete operations. A publicly available proof-of-concept exploit exists, and no vendor patch has been issued following disclosure; the vendor was unresponsive to coordinated disclosure.
Improper access control in Doccano's Project Example Detail endpoint allows authenticated low-privilege users to access, modify, or otherwise interact with project annotation data beyond their authorization scope. Versions up to 1.8.5 of both the Open Source Annotation Tools and Auto Labeling Pipeline Module components are confirmed affected. A publicly available proof-of-concept exploit exists; no vendor patch has been released and the vendor did not respond to responsible disclosure, leaving deployments exposed with no official remediation path.