HIGH🇬🇧 English

CVE-2026-23526

CVSS 8.5v4.0pub. 2026-01-21upd. 2026-02-20

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Cvat Computer Vision Annotation Tool

    APP
    Cvat
    1.0.0 – 2.55.0 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2021-45046CRITICAL9.0⚠ KEVten sam produkt

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-defau...

CVE-2026-23516HIGH8.6ten sam produkt

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 thro...

CVE-2025-23045HIGH8.7ten sam produkt

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. ...

CVE-2024-37164HIGH7.1ten sam produkt

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. ...

CVE-2024-37306HIGH7.1ten sam produkt

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. ...