PT-2026-6917 · Unknown · Jsbroks Coco Annotator

Nmmorette · Publicado 2026-02-07 · Atualizado 2026-02-27 · CVE-2026-2109

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsbroks COCO Annotator versions up to 0.11.1

Description A flaw exists in jsbroks COCO Annotator that allows for improper authorization. This issue is related to the manipulation of the ID argument within an unknown function of the /api/undo/ file in the Delete Category Handler component. The attack can be initiated remotely, and an exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 0.11.1 should be used.

Exploit

Correção

Improper Authorization

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-285

CWE-266

Identificadores relacionados

CVE-2026-2109

Produtos afetados

Jsbroks Coco Annotator

Referências · 10

• 🔥 https://github.com/nmmorette/vulnerability-research/blob/main/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo%202f1ef09b8736807aa1f7ede4b64fa35d.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2109 · Nota de Segurança
• https://t.me/CVEtracker/44048 · Publicação no Telegram
• https://t.me/cveNotify/151261 · Publicação no Telegram
• https://vuldb.com/?id.344685 · Nota
• https://twitter.com/CVEnew/status/2020225451143159821 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-2109 · Aviso do Fabricante
• https://vuldb.com/?submit.745579 · Nota
• https://t.me/cveNotify/153468 · Publicação no Telegram
• https://vuldb.com/?ctiid.344685 · Nota