PT-2026-85045 · Unknown · Label Studio

George Chen

·

CVE-2026-85211

·

Published

2026-09-03

·

Updated

2026-09-03

CVSS v3.1

7.7

High

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.23.1
Description Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects within the proxy api.py endpoints. This allows attackers to access cloud storage objects belonging to other tenants by creating a separate organization and providing arbitrary file URIs to presign or stream bucket contents.
Recommendations Update Label Studio to version 1.23.1 or later.

Exploit

Fix

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-85211

Affected Products

Label Studio