Description
A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-05-03
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the Dataset API of jsbroks COCO Annotator, where an attacker can manipulate the DatasetId parameter to bypass authentication checks. This allows an unauthenticated or improperly authenticated user to identify and modify datasets that they should not have access to. The weakness corresponds to CWE-285 and CWE-639, and the impact is potential unauthorized alteration of dataset contents, compromising data integrity and confidentiality for users relying on the annotator for accurate ground‑truth data.

Affected Systems

The affected product is jsbroks COCO Annotator, versions up to 0.11.1. Any installation running these releases, particularly when exposed to external networks, is vulnerable. The manipulation occurs in the backend/webserver/api/datasets.py module of the Dataset API.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk, and the vulnerability can be exploited remotely by sending a crafted HTTP request with a manipulated DatasetId. While no EPSS score is available, the public disclosure and lack of vendor response suggest a real threat. The issue is not listed in the CISA KEV catalog, but the combination of remote exploitability and authentication bypass warrants immediate attention.

Generated by OpenCVE AI on May 3, 2026 at 06:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade jsbroks COCO Annotator to the latest release, which contains a fix for the DatasetId authentication bypass.
  • If upgrading is not possible, limit access to the Dataset API to trusted internal networks using firewall rules or a reverse‑proxy that enforces authentication.
  • As a temporary workaround, implement manual role‑based access checks on the Dataset API—confirm that the caller’s session is authorized to view or modify the requested DatasetId before accepting the request.
  • Monitor API logs for anomalous DatasetId usage and set up alerts for repeated unauthorized attempts.

Generated by OpenCVE AI on May 3, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 03 May 2026 05:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title jsbroks COCO Annotator Dataset API datasets.py authorization
First Time appeared Jsbroks
Jsbroks coco Annotator
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:jsbroks:coco_annotator:*:*:*:*:*:*:*:*
Vendors & Products Jsbroks
Jsbroks coco Annotator
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jsbroks Coco Annotator
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-03T05:00:14.422Z

Reserved: 2026-05-02T08:42:51.998Z

Link: CVE-2026-7681

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-03T06:15:58.190

Modified: 2026-05-03T06:15:58.190

Link: CVE-2026-7681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-03T06:30:05Z

Weaknesses