The vulnerability is an improper authorization flaw in CVAT’s QualityReportViewSet.get_queryset method, where a missing check_object_permissions call on the parent_id query parameter allows authenticated users to probe the existence of quality reports belonging to other organizations. An attacker can send requests with sequential integer parent_id values and distinguish between existing and non‑existing reports by the differing HTTP responses (500 for existing, 404 for non‑existing), leaking cross‑organization report existence without exposing report content.

The affected product is CVAT from cvat‑ai:cvatt. All released versions prior to 2.69.0 are vulnerable; there is no specific sub‑version information listed beyond the < 2.69.0 threshold.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access to the CVAT API. By iterating parent_id values and interpreting the status code differences, an attacker can enumerate which quality reports exist for other organizations, providing information that could be leveraged for further reconnaissance.