CVE-2026-82834

MediumCVSS 5.4

Published: 31/08/2026(UTC)Updated: 02/09/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

A security flaw has been discovered in Doccano Open Source Annotation Tools up to version 1.8.5. It affects the LabelList function in the file /v1/projects/1/category-types of the Bulk-Delete Endpoint component. Performing a manipulation results in improper access controls. Remote exploitation is possible, and the exploit is public.

Risk Assessment

The risk is the possibility of remote exploitation to gain unauthorized access to category deletion functionality, potentially leading to data integrity issues.

Recommendation

It is recommended to upgrade Doccano to version 1.8.5 or later that fixes this vulnerability. Also restrict access to the Bulk-Delete endpoint to authorized users.

Other vulnerabilities in Doccano

CVE-2026-82833Medium
A vulnerability was identified in Doccano Open Source Annotation Tools up to version 1.8.5. It affects the ExampleDetail function in the file /v1/projects/1/examples/ of the Project Example Detail Endpoint component. Such manipulation leads to improper access controls. The attack may be launched remotely, and the exploit is publicly available.

Original NVD description (English source)

A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component Bulk-Delete Endpoint. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS