CVE-2026-2109

Name of the Vulnerable Software and Affected Versions jsbroks COCO Annotator versions up to 0.11.1

Description A flaw exists in jsbroks COCO Annotator that allows for improper authorization. This issue is related to the manipulation of the ID argument within an unknown function of the /api/undo/ file in the Delete Category Handler component. The attack can be initiated remotely, and an exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions prior to 0.11.1 should be used.