PT-2026-53931 · Cvat Ai · Cvat

George Chen · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58373

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check object permissions call on the parent id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-58373

Affected Products

Cvat

References · 5

• https://github.com/cvat-ai/cvat/commit/27953f19d2265f8b495369f816730a7452db791b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58373 · Security Note
• https://github.com/cvat-ai/cvat/releases/tag/v2.69.0 · Note
• https://github.com/cvat-ai/cvat/pull/10807 · Note
• https://vulncheck.com/advisories/cvat-missing-authorization-on-quality-reports-parent-id-filter-leaks-cross-organization-report-existence · Note