Name of the Vulnerable Software and Affected Versions:

CVAT versions 1.1.0 through 2.41.0

Description:

CVAT is an open source interactive video and image annotation tool for computer vision. Email verification was not enforced when using Basic HTTP Authentication in versions 1.1.0 through 2.41.0, allowing users to create accounts with fake email addresses and be treated as verified users. This also leaves the system open to bot signups and further usage.

Recommendations:

Update to version 2.42.0 or later.

For CVAT Enterprise customers, disable registration to prevent this issue.