CVE-2026-85211
Label Studio through 1.23.0 Cross-Organization Storage URI Resolution
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.
| CWE | CWE-639 |
| Vendor | humansignal |
| Product | label-studio |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for humansignal label-studio
Be the first to know when new high vulnerabilities affecting humansignal label-studio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
HumanSignal / label-studio
0 ≤ 1.23.0
References
github.com: https://github.com/HumanSignal/label-studio/issues/9924 github.com: https://github.com/HumanSignal/label-studio github.com: https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/io_storages/proxy_api.py vulncheck.com: https://www.vulncheck.com/advisories/label-studio-through-1.23.0-cross-organization-storage-uri-resolution
Credits
🔍 George Chen