Improper Authorization in CVAT Affects Quality Report Management

CVE-2026-58373

What is CVE-2026-58373?

CVAT versions prior to 2.69.0 are susceptible to an improper authorization vulnerability within the QualityReportViewSet.get_queryset method. This issue allows authenticated users to exploit the API by sending sequential integer values for the parent_id parameter. Attackers can discern whether quality report identifiers exist across different organizations based on the responses returned from the server — distinguishing between a 500 Internal Server Error for existing reports and a 404 Not Found for non-existing ones. This flaw enables leakage of report existence information without revealing any actual report content, posing significant privacy risks across organizations.

References