Read the docs
TI-2026-53251 Aliases CVE-2026-76073GHSA-f3mm-hmc7-j4qg

Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Priority MEDIUM 40CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HumanSignallabel-studioup to 1.23.0—No fix listedCNA
  • label-studio VendorHumanSignal Affected up to 1.23.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*——HumanSignal
  • cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:* Versions — — ·HumanSignal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76073
  2. 2026-10-03 Alias added: GHSA-f3mm-hmc7-j4qg

References

Other 3

  • TI-2023-23482 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVSS 3.1CRITICAL 9.8
  • TI-2025-18949 Label Studio has a Path Traversal Vulnerability via image Field CVSS 4.0HIGH 8.7
  • TI-2025-18951 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVSS 3.1HIGH 8.6
  • TI-2023-25457 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio CVSS 3.1HIGH 7.5
  • TI-2026-58512 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL CVSS 4.0HIGH 8.4
  • TI-2026-17727 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVSS 4.0HIGH 8.6
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences