CVE-2026-76073

{"id": "CVE-2026-76073", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76073", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T15:57:15.967630Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/HumanSignal/label-studio", "vendor": "HumanSignal", "product": "label-studio", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.23.0"}], "packageURL": "pkg:pypi/label-studio", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T18:17:21.410", "references": [{"url": "https://github.com/HumanSignal/label-studio", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/tasks/api.py", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/HumanSignal/label-studio/issues/9796", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/label-studio-through-cross-organization-annotation-access-via-unscoped-annotationapi-queryset", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file."}, {"lang": "es", "value": "Label Studio no limita el alcance del endpoint de detalle de anotaci\u00f3n a la organizaci\u00f3n del usuario solicitante. AnnotationAPI en label_studio/tasks/api.py declara queryset = Annotation.objects.all() y no proporciona ninguna anulaci\u00f3n de get_queryset, por lo que la b\u00fasqueda predeterminada recupera cualquier anotaci\u00f3n por clave primaria. Las entradas permission_required de la vista nombran annotations.view, annotations.change y annotations.delete, y label_studio/core/permissions.py registra cada permiso con rules.is_authenticated, por lo que la verificaci\u00f3n es satisfecha por cualquier cuenta con sesi\u00f3n iniciada y no se ejecuta ninguna prueba de organizaci\u00f3n a nivel de objeto. El endpoint de tarea hermano s\u00ed restringe su queryset con project__organization establecido en la organizaci\u00f3n activa del solicitante, lo cual es el l\u00edmite que esta ruta omite. Los identificadores de anotaci\u00f3n son enteros secuenciales, por lo que un usuario autenticado de una organizaci\u00f3n puede enumerar identificadores para leer, modificar y eliminar anotaciones pertenecientes a otras organizaciones en la misma instancia. El mismo queryset sin alcance aparece en AnnotationConvertAPI en el mismo archivo."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}