CVE-2026-82834

Name of the Vulnerable Software and Affected Versions Doccano Open Source Annotation Tools for Machine Learning Practitioners versions prior to 1.8.6

Description Improper access controls exist within the Bulk-Delete Endpoint component. This issue affects the LabelList() function associated with the '/v1/projects/1/category-types' endpoint, allowing for remote exploitation through manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/v1/projects/1/category-types' endpoint to minimize the risk of exploitation.