PT-2026-53931 · Cvat Ai · Cvat

George Chen · Publicado 2026-06-30 · Atualizado 2026-06-30 · CVE-2026-58373

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check object permissions call on the parent id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-58373

Produtos afetados

Cvat

Referências · 5

• https://github.com/cvat-ai/cvat/commit/27953f19d2265f8b495369f816730a7452db791b · Correção
• https://github.com/cvat-ai/cvat/releases/tag/v2.69.0 · Nota
• https://github.com/cvat-ai/cvat/pull/10807 · Nota
• https://vulncheck.com/advisories/cvat-missing-authorization-on-quality-reports-parent-id-filter-leaks-cross-organization-report-existence · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58373 · Nota de Segurança