CVE-2026-58373: CVAT Quality Report Enumeration Vulnerability (CWE-862)

Technical summary

CVE-2026-58373 stems from missing permission checks in QualityReportViewSet.get_queryset. The vulnerability allows authenticated attackers to enumerate quality report identifiers across organizational boundaries via the parent_id query parameter. The absence of a check_object_permissions call on this parameter enables enumeration attacks: by iterating through sequential parent_id values, attackers can distinguish between existing reports (HTTP 500) and non-existing reports (HTTP 404), achieving cross-organization report existence disclosure without accessing report data. The flaw is classified as improper authorization (CWE-862).

Business impact

Information disclosure of report metadata—specifically the existence of quality reports belonging to other organizations—can inform competitive intelligence or reconnaissance activities. While report content remains inaccessible, the disclosure of which organizations maintain quality reports for specific annotation projects poses a confidentiality risk. For multi-tenant CVAT deployments, this undermines organizational isolation expectations and may trigger audit or compliance concerns, particularly in regulated environments handling sensitive annotation work.

Affected systems

CVAT versions prior to 2.69.0 are vulnerable. Organizations using CVAT for computer vision annotation should verify their deployed version. The vulnerability requires valid authentication, meaning casual external attackers cannot exploit it; however, any authenticated user—including those with minimal privileges—can perform the enumeration.

Exploitability

Exploitation is straightforward for any authenticated user. The attack requires only HTTP requests with sequential integer values in the parent_id parameter, making it trivially automatable. No special tools, social engineering, or race conditions are needed. The attack surface is the quality reports API endpoint itself, exposed to any user with valid login credentials.

Remediation

Upgrade CVAT to version 2.69.0 or later. Verify against the official CVAT project releases and advisories. Organizations unable to upgrade immediately should implement network-level access controls to restrict unauthenticated API access and monitor for suspicious enumeration patterns (rapid sequential requests to the quality reports endpoint).

Patch guidance

Deploy CVAT 2.69.0 or a later patch version that includes the authorization fix. Consult the official CVAT release notes and security advisories to confirm that the patch explicitly addresses the QualityReportViewSet.get_queryset permission check. Test the upgrade in a staging environment before production rollout to verify compatibility with existing configurations and third-party integrations.

Detection guidance

Look for repeated requests to the quality reports API endpoint with incrementing or sequential parent_id values, especially when responses alternate between HTTP 404 and HTTP 500 status codes or vary in response time. Implement logging on the QualityReportViewSet.get_queryset method to identify requests lacking proper permission validation. Monitor for authenticated users querying parent_id values outside their own organization scope.

Why prioritize this

Although the CVSS score is moderate (4.3), the vulnerability warrants timely remediation because it requires only minimal attacker capability (valid credentials) and introduces cross-organizational data leakage in a multi-tenant setting. Organizations relying on organizational isolation must patch to maintain confidentiality boundaries. The ease of exploitation and potential compliance implications elevate practical priority above the base CVSS score.

Risk score, explained

The CVSS v3.1 score of 4.3 (MEDIUM) reflects: Network-accessible attack vector; Low attack complexity; Requirement for prior authentication; No user interaction; Limited scope; and Low confidentiality impact (information disclosure without data exfiltration). The score appropriately captures the absence of integrity or availability impact and the authentication barrier, but organizations should layer in operational context—tenant isolation criticality, internal threat model, and regulatory posture—when determining internal risk.

Frequently asked questions