CVE-2025-48381: CVAT Information Disclosure Vulnerability

CVE-2025-48381 Overview

CVE-2025-48381 is an information disclosure vulnerability in the Computer Vision Annotation Tool (CVAT), an interactive video and image annotation tool for computer vision workflows. The flaw affects CVAT versions 2.4.0 through 2.37.x. An authenticated user can retrieve the IDs and names of all tasks, projects, and labels, along with the IDs of all jobs and quality reports, regardless of assigned permissions. The same enumeration behavior can tie up backend resources when the instance contains large numbers of objects, denying service to legitimate users. The issue is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data] and was patched in version 2.38.0.

Critical Impact
Any authenticated CVAT account can enumerate cross-tenant metadata for tasks, projects, labels, jobs, and quality reports, and can trigger resource exhaustion on large instances.

Affected Products

CVAT (Computer Vision Annotation Tool) versions >= 2.4.0 and < 2.38.0
Self-hosted CVAT deployments exposing the REST API to authenticated users
Multi-tenant CVAT instances relying on per-object permission enforcement

Discovery Timeline

2025-05-30 - CVE-2025-48381 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48381

Vulnerability Analysis

CVAT exposes REST API endpoints that allow authenticated users to list and filter resources such as tasks, projects, labels, jobs, and quality reports. In versions 2.4.0 through 2.37.x, the filter and search logic in cvat/apps/engine/filters.py does not sufficiently constrain result sets to objects the caller is authorized to view. As a result, authenticated users can craft queries that return identifiers and human-readable names for resources belonging to other users or organizations.

The secondary impact is availability. Because the filtering pipeline evaluates queries across the full object set before applying visibility rules, large instances materialize substantial querysets in memory and database time. Repeated enumeration calls can saturate database connections and worker threads, degrading service for legitimate users.

Root Cause

The root cause is over-permissive query construction in CVAT's Django-based filter layer. Authorization was applied at the object-detail level rather than being pushed into the base queryset used by list and search operations. Sensitive metadata (id, name) therefore leaked through listing endpoints even when direct object retrieval would have been denied.

Attack Vector

Exploitation requires only a low-privileged authenticated session on the CVAT instance. The attacker issues repeated list or search requests against endpoints backing tasks, projects, labels, jobs, and quality reports, harvesting identifiers and names. Those identifiers can be used to map internal project structures, identify high-value targets for follow-on social engineering, or drive denial-of-service by forcing the server to compute large filtered result sets.

python

 from textwrap import dedent
 from typing import Any, Optional

+from django.db import models
 from django.db.models import Q
 from django.db.models.query import QuerySet
 from django.utils.encoding import force_str

Source: cvat-ai/cvat commit 7136c99. The upstream fix reworks the filter module in cvat/apps/engine/filters.py to constrain querysets before serialization.

Detection Methods for CVE-2025-48381

Indicators of Compromise

High-volume authenticated GET requests to CVAT list endpoints such as /api/tasks, /api/projects, /api/labels, /api/jobs, and /api/quality/reports from a single user.
Repeated paginated queries iterating through page or page_size parameters against the same endpoint within a short window.
Sudden spikes in database CPU or connection count correlated with authenticated API traffic to CVAT filter endpoints.

Detection Strategies

Baseline typical API call rates per user role and alert on deviations against listing endpoints affected by the advisory.
Correlate application logs from CVAT with database slow-query logs to identify enumeration patterns that trigger expensive filtered queries.
Review access logs for accounts requesting resources they have never previously edited or been assigned to.

Monitoring Recommendations

Forward CVAT application, NGINX, and PostgreSQL logs to a centralized SIEM for correlation and long-term retention.
Enable audit logging for authenticated API calls and retain sufficient history to reconstruct enumeration sessions.
Monitor CVAT worker and database resource utilization to detect the denial-of-service condition described in the advisory.

How to Mitigate CVE-2025-48381

Immediate Actions Required

Upgrade CVAT to version 2.38.0 or later, which contains the fix delivered in commit 7136c99.
Inventory all CVAT deployments, including internal and lab instances, and confirm the running version.
Rotate or review API tokens for accounts that were active during the vulnerable window if the instance is multi-tenant.

Patch Information

The vendor released a fix in CVAT 2.38.0. Details are available in the CVAT GHSA-7484-2gfm-852p advisory and the upstream commit 7136c99. Administrators should follow the standard CVAT upgrade path for their deployment method (Docker Compose, Helm, or source install) and validate that the running version reports 2.38.0 or higher after the upgrade.

Workarounds

Restrict CVAT access to trusted networks using firewall rules or a reverse proxy allowlist until the upgrade is applied.
Reduce the account footprint by disabling unused CVAT users and enforcing least-privilege role assignments.
Apply rate limiting at the reverse proxy for authenticated API endpoints to blunt enumeration and resource exhaustion attempts.

bash

# Example NGINX rate limit for CVAT API endpoints
limit_req_zone $binary_remote_addr zone=cvat_api:10m rate=5r/s;

server {
    location /api/ {
        limit_req zone=cvat_api burst=10 nodelay;
        proxy_pass http://cvat_backend;
    }
}