CVE-2026-76073

Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Published Aug 24, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.

Analysis

Technical impact

Label Studio fails to restrict the AnnotationAPI to the organization of the requesting user. The endpoint’s queryset is set to all annotations, and the permission checks only enforce that the user is authenticated, not that they belong to the same organization. Consequently, any authenticated user can construct annotation identifiers and gain read, write, or delete capabilities on annotations that belong to other organizations. This vulnerability allows data leakage, integrity compromise, and potential deletion of cross‑organization annotation content.

Affected Systems

HumanSignal Label Studio versions up to and including 1.23.0 are affected. The flaw is present in the annotation detail and AnnotationConvertAPI endpoints, both located in the tasks API module of the 1.23.0 release.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity remote attack surface. Although the EPSS score is currently not available, the vulnerability is not listed in CISA’s KEV catalog. Attackers only need to authenticate to the instance; enumeration of sequential annotation identifiers is trivial, enabling cross‑organization data access. Because no object‑level checks are performed, the exploit requires no additional privileges beyond login credentials, making it highly actionable.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HumanSignal

label-studio

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.23.0

No data.

Vendor Product Versions

Humansignal

Label Studio

Version	Status	Scheme	Platform
`[0,1.23.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Label Studio to the latest version that contains the annotation scoping fix.
If an upgrade is not immediately possible, revoke AnnotationAPI permissions for all users and assign new token scopes that enforce organization membership.
Apply the repository patch or modify the AnnotationAPI queryset to filter by the requester's active organization before processing requests.
Monitor audit logs for abnormal enumeration patterns or cross‑organization annotation activity to detect potential exploitation.

Generated by OpenCVE AI on August 24, 2026 at 20:30 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.523% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/HumanSignal/label-studio
https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/tasks/api.py
https://github.com/HumanSignal/label-studio/issues/9796
https://www.vulncheck.com/advisories/label-studio-through-cross-organization-annotation-access-via-unscoped-annotationapi-queryset

History

Aug 28, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 6:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.
Title		Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset
First Time appeared		Humansignal Humansignal label Studio
Weaknesses		CWE-639
CPEs		cpe:2.3:a:humansignal:label_studio::::::::
Vendors & Products		Humansignal Humansignal label Studio
References		https://github.com/HumanSignal/label-studio https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/tasks/api.py https://github.com/HumanSignal/label-studio/issues/9796 https://www.vulncheck.com/advisories/label-studio-through-cross-organization-annotation-access-via-unscoped-annotationapi-queryset
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`