CVE-2026-7681
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A security vulnerability was detected in jsbroks COCO Annotator up to 0.11.1 affecting the Dataset API component (backend/webserver/api/datasets.py). Manipulation of the DatasetId argument leads to authorization bypass, and the attack may be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.
Risk Assessment
A remote attacker could access data or operations reserved for other users, violating access control. The public exploit increases the risk of exploitation.
Recommendation
Enforce proper permission checks for the DatasetId argument and restrict API access to trusted users until a fix is released.
Other vulnerabilities in COCO Annotator
Original NVD description (English source)
A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS