PT-2026-6917 · Unknown · Jsbroks Coco Annotator

Nmmorette · CVE-2026-2109 · Published 2026-02-07 · Updated 2026-02-27

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsbroks COCO Annotator versions up to 0.11.1

Description A flaw exists in jsbroks COCO Annotator that allows for improper authorization. This issue is related to the manipulation of the ID argument within an unknown function of the /api/undo/ file in the Delete Category Handler component. The attack can be initiated remotely, and an exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 0.11.1 should be used.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-2109

Affected Products

Jsbroks Coco Annotator

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2109.json · Exploit
• 🔥 https://github.com/nmmorette/vulnerability-research/blob/main/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo%202f1ef09b8736807aa1f7ede4b64fa35d.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2109 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2109 · Vendor Advisory
• https://t.me/cveNotify/153468 · Telegram Post
• https://twitter.com/CVEnew/status/2020225451143159821 · Twitter Post
• https://t.me/CVEtracker/44048 · Telegram Post
• https://vuldb.com/?id.344685 · Note
• https://vuldb.com/?submit.745579 · Note
• https://vuldb.com/?ctiid.344685 · Note
• https://t.me/cveNotify/151261 · Telegram Post