Improper Access Control in Doccano Open Source Annotation Tools
CVE-2026-82834

5.3MEDIUM

Key Information:

Vendor: Doccano
Status: Open Source Annotation Tools For Machine Learning Practitioners; Auto Labeling Pipeline Module To Annotate A Document Automatically
Vendor: CVE Published:; 31 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-82834?

A security issue has been identified in the Doccano Open Source Annotation Tools, particularly within the Bulk-Delete Endpoint for the LabelList function. This vulnerability allows for improper access control, potentially enabling remote exploitation. The issue affects versions of Doccano up to and including v1.8.5 and arises from inadequate safeguards on the endpoint at /v1/projects/1/category-types. An attacker could leverage this flaw to perform unauthorized actions, posing a significant security risk. Despite early notification to the vendor, no response was received regarding this critical issue.

Affected Version(s)

Auto Labeling Pipeline Module to Annotate a Document Automatically 1.8.0

Auto Labeling Pipeline Module to Annotate a Document Automatically 1.8.1

Auto Labeling Pipeline Module to Annotate a Document Automatically 1.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-82834 - Proof of Concept