CVE-2026-73221
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
CVAT from version 2.17.0 until 2.72.0 has a vulnerability that allows a user with the Worker role to use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
Risk Assessment
Unauthorized access to annotation requests could expose sensitive data about tasks and allow disruption of other users' work, potentially compromising confidentiality and process integrity.
Recommendation
It is recommended to immediately upgrade CVAT to version 2.72.0 or later. Also, review user permissions and restrict access to lambda endpoints.
Original NVD description (English source)
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.