Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73221CVAT: Flawed authorization logic in endpoints related to lambda requests

Medium 5.3

In plain English

A medium-severity incorrect authorization in cvat from cvat-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.

Affected products (as reported)

Vendor	Product	Versions
cvat-ai	cvat	>= 2.17.0, < 2.72.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-m7p7-6w4m-886p x_refsource_CONFIRM
https://github.com/cvat-ai/cvat/pull/10964 x_refsource_MISC
https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b121e40f16d66d373b3f7 x_refsource_MISC
https://github.com/cvat-ai/cvat/releases/tag/v2.72.0 x_refsource_MISC