CVE-2026-7681

MEDIUM

jsbroks COCO Annotator Dataset API datasets.py authorization

Title source: cna

Description

A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-360834 | jsbroks COCO Annotator Dataset API datasets.py authorization

https://vuldb.com/vuln/360834

Signature, Permissions Required signature permissions-required

VDB-360834 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/360834/cti

Third Party Advisory third-party-advisory

Submit #801408 | jsbroks COCO Annotator 0.11.1 Authorization Bypass

https://vuldb.com/submit/801408

Exploit broken-link exploit

https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Unauthenticated%20Dataset%20Modification%20via%20Missing%20Authentication

View Exploit ZIP pw:eip

Scores

CVSS v3 6.5

EPSS 0.0005

EPSS Percentile 15.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-285 CWE-639

Status published

Products (2)

jsbroks/COCO Annotator 0.11.0

jsbroks/COCO Annotator 0.11.1

Published May 03, 2026

Tracked Since May 03, 2026