Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints, allowing a user who creates a separate organization to supply arbitrary file URIs to presign or stream bucket contents. This flaw bypasses the intended authorization checks and enables unauthorized access to cloud storage objects belonging to other tenants. The result is a confidentiality breach that exposes sensitive data to attackers and allows them to read, download, or potentially modify storage objects that belong to other organizations.

The affected product is HumanSignal's Label Studio. All releases up to and including version 1.23.0 are impacted; any installation of Label Studio 1.23.0 or earlier that still hosts the vulnerable proxy_api.py endpoints is vulnerable.

The vulnerability carries a CVSS score of 8.3, indicating high severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely by interacting with the Label Studio API, creating a new organization, and supplying a file URI that points to another tenant's cloud storage bucket. Because organization creation is typically permissive, the attack requires no special privileges beyond standard API access. Once the storage URI is resolved, the attacker can presign or stream the target object, providing read access to data belonging to other tenants, which constitutes significant data exposure across tenant boundaries.