CVE-2026-58373

Name of the Vulnerable Software and Affected Versions CVAT versions prior to 2.69.0

Description An improper authorization issue exists in the QualityReportViewSet.get queryset function. Authenticated attackers can enumerate quality report identifiers from other organizations by exploiting a missing check object permissions call on the parent id query parameter of the quality reports API endpoint. By sending requests with sequential integer values for parent id, attackers can distinguish between existing and non-existing reports based on whether the server returns an HTTP 500 or HTTP 404 response, thereby disclosing the existence of reports across different organizations without accessing the actual report content.

Recommendations Update to version 2.69.0 or later. As a temporary mitigation, restrict access to the parent id parameter in the quality reports API endpoint.