CVE-2026-7681

Name of the Vulnerable Software and Affected Versions jsbroks COCO Annotator versions prior to 0.11.2

Description An authorization bypass exists in the Dataset API within the file backend/webserver/api/datasets.py. A remote attacker can initiate this attack by manipulating the DatasetId argument.

Recommendations Update to a version later than 0.11.1. As a temporary workaround, restrict access to the DatasetId argument in the Dataset API to minimize the risk of exploitation.