CVE-2026-7681

jsbroks COCO Annotator Dataset API datasets.py authorization

View on CVE.org
Published May 3, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability lies in the Dataset API of jsbroks COCO Annotator, where an attacker can manipulate the DatasetId parameter to bypass authentication checks. This allows an unauthenticated or improperly authenticated user to identify and modify datasets that they should not have access to. The weakness corresponds to CWE-285 and CWE-639, and the impact is potential unauthorized alteration of dataset contents, compromising data integrity and confidentiality for users relying on the annotator for accurate ground‑truth data.

Affected Systems

The affected product is jsbroks COCO Annotator, versions up to 0.11.1. Any installation running these releases, particularly when exposed to external networks, is vulnerable. The manipulation occurs in the backend/webserver/api/datasets.py module of the Dataset API.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk, and the vulnerability can be exploited remotely by sending a crafted HTTP request with a manipulated DatasetId. While no EPSS score is available, the public disclosure and lack of vendor response suggest a real threat. The issue is not listed in the CISA KEV catalog, but the combination of remote exploitability and authentication bypass warrants immediate attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade jsbroks COCO Annotator to the latest release, which contains a fix for the DatasetId authentication bypass.
  • If upgrading is not possible, limit access to the Dataset API to trusted internal networks using firewall rules or a reverse‑proxy that enforces authentication.
  • As a temporary workaround, implement manual role‑based access checks on the Dataset API—confirm that the caller’s session is authorized to view or modify the requested DatasetId before accepting the request.
  • Monitor API logs for anomalous DatasetId usage and set up alerts for repeated unauthorized attempts.

Generated by OpenCVE AI on May 3, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title jsbroks COCO Annotator Dataset API datasets.py authorization
First Time appeared Jsbroks
Jsbroks coco Annotator
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:jsbroks:coco_annotator:*:*:*:*:*:*:*:*
Vendors & Products Jsbroks
Jsbroks coco Annotator
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 5, 2026, 12:37 AM
Reserved
May 2, 2026, 8:42 AM

View source JSON

Updated
May 5, 2026, 12:37 AM

JSON

Status
Deferred
Published
May 3, 2026, 6:15 AM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
May 3, 2026, 6:30 AM

JSON