Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck
CVE-2026-76073Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset
High 8.8
In plain English
A high-severity authorization bypass via user-controlled key in label-studio from HumanSignal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HumanSignal | label-studio | 0 – through 1.23.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/HumanSignal/label-studio product
- https://github.com/HumanSignal/label-studio/issues/9796 issue-tracking
- https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/tasks/api.py technical-description
- VulnCheck Advisory: Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset third-party-advisory