Cross-Organization Access in Label Studio Affects User Data Security

CVE-2026-76073

What is CVE-2026-76073?

Label Studio contains a vulnerability in its AnnotationAPI that allows unauthorized users to access, modify, and delete annotations across different organizations. The issue arises because the API does not appropriately scope the annotation detail endpoint to the user's organization. This lack of organization-based access control means that authenticated users can enumerate sequential annotation identifiers, potentially compromising sensitive data by manipulating or deleting annotations belonging to other organizations within the same Label Studio instance. This flaw also exists in the AnnotationConvertAPI, underscoring the need for enhanced security measures in API design to prevent cross-organization data exposure.

References