CVE-2026-58373
CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.
| CWE | CWE-862 |
| Vendor | cvat-ai |
| Product | cvat |
| Published | Jun 30, 2026 |
| Last Updated | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for cvat-ai cvat
Be the first to know when new medium vulnerabilities affecting cvat-ai cvat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
cvat-ai / cvat
0 < 2.69.0
References
github.com: https://github.com/cvat-ai/cvat/releases/tag/v2.69.0 github.com: https://github.com/cvat-ai/cvat/pull/10807 github.com: https://github.com/cvat-ai/cvat/commit/27953f19d2265f8b495369f816730a7452db791b vulncheck.com: https://www.vulncheck.com/advisories/cvat-missing-authorization-on-quality-reports-parent-id-filter-leaks-cross-organization-report-existence
Credits
George Chen