In CVAT versions 1.0.0 through 2.54.0 a staff‑level user is permitted to change the permissions of any account, including granting themselves superuser rights and adding themselves to the administrator group. This flaw allows an authorized staff member to gain unrestricted access to all data stored in the CVAT instance, effectively making the entire system vulnerable to data theft, modification, or deletion. The weakness corresponds to improper user role validation (CWE‑267).

The vulnerability is confined to the open‑source Computer Vision Annotation Tool (CVAT) manufactured by cvat‑ai. All releases from 1.0.0 up to and including 2.54.0 are affected; version 2.55.0 and later contain the fix.

The CVSS score of 8.5 classifies this as a high‑severity issue, but the EPSS score is below 1%, indicating a very low probability of exploitation at the time of analysis and no listing in the CISA KEV catalogue. Exploitation requires an attacker to possess a staff account or to create one by compromising an existing staff account. Once in that role, the attack path is straightforward: the compromised user can immediately elevate privileges without further external interaction. The attack vector is therefore inferred as an authenticated privilege‑escalation scenario rather than a remote code execution or network‑level exploit.