Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-23526

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ae9c9b1dc516eeec91019a9b7e7c5e5fba1cd5b43410c62c2fc8bfc0dc4ced04
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"cvat","vendor":"cvat-ai","versions":[{"status":"affected","version":">= 1.0.0, < 2.55.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:05f1b02e1614e17aa173668407fae62c980a81311187680cb2ad2d6ef95360d6 · sha256:20122f60f723534f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:05f1b02e1614e17aa173668407fae62c980a81311187680cb2ad2d6ef95360d6 · sha256:20122f60f723534f… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-267","description":"CWE-267: Privilege Defined With Unsafe Actions","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:05f1b02e1614e17aa173668407fae62c980a81311187680cb2ad2d6ef95360d6 · sha256:20122f60f723534f… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4","tags":["x_refsource_MISC"],"url":"https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:05f1b02e1614e17aa173668407fae62c980a81311187680cb2ad2d6ef95360d6 · sha256:20122f60f723534f… · /containers/cna/references/1
{"name":"https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7","tags":["x_refsource_CONFIRM"],"url":"https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:05f1b02e1614e17aa173668407fae62c980a81311187680cb2ad2d6ef95360d6 · sha256:20122f60f723534f… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer