CVE-2026-58373: Cvat Computer Vision Annotation Tool

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.

Affected products

• Cvat Computer Vision Annotation Tool: before 2.69.0 (fixed in 2.69.0)

Published 2026-06-30. Last modified 2026-07-14.