CVE-2026-76073

Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.23.1

Description Label Studio fails to scope the annotation detail endpoint to the requesting user's organization. In the label studio/tasks/api.py file, the AnnotationAPI and AnnotationConvertAPI use a queryset that retrieves all annotations by primary key without an override to restrict access to the user's active organization. Because permissions are satisfied by any authenticated account and lack object-level organization tests, an authenticated user can enumerate sequential integer identifiers to read, modify, or delete annotations belonging to other organizations on the same instance.

Recommendations Update Label Studio to version 1.23.1 or later.