CVE-2026-58373: CVAT Information Disclosure Vulnerability

CVE-2026-58373 Overview

CVE-2026-58373 is an improper authorization vulnerability [CWE-862] in Computer Vision Annotation Tool (CVAT) versions prior to 2.69.0. The flaw resides in the QualityReportViewSet.get_queryset method of the quality reports API endpoint. The endpoint fails to invoke check_object_permissions on the parent_id query parameter, allowing authenticated attackers to enumerate quality report identifiers belonging to other organizations. Attackers can iterate sequential integer parent_id values and distinguish existing from non-existing reports by observing HTTP 500 versus HTTP 404 response differences.

Critical Impact
Authenticated users across tenant boundaries can enumerate cross-organization quality report identifiers, disclosing report existence without exposing report contents.

Affected Products

CVAT versions prior to 2.69.0
CVAT self-hosted deployments running vulnerable versions
CVAT multi-tenant instances with authenticated users across organizations

Discovery Timeline

2026-06-30 - CVE-2026-58373 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in the NVD database

Technical Details for CVE-2026-58373

Vulnerability Analysis

The vulnerability exists in CVAT's quality control module, specifically the Django REST Framework viewset that handles GET /api/quality/reports. When the request includes a parent_id query parameter, the view retrieves the referenced QualityReport object without executing the object-level permission check that other code paths enforce. As a result, an authenticated user in one organization can supply a parent_id referencing a report owned by another organization. The server distinguishes between valid and invalid identifiers through response codes, producing an observable oracle for cross-tenant enumeration.

The underlying weakness is classified as Missing Authorization [CWE-862]. While the endpoint does not return the report body, the differential response leaks metadata about the existence and identifier space of other tenants' resources. This enables reconnaissance against multi-tenant CVAT deployments and violates tenant isolation guarantees.

Root Cause

In cvat/apps/quality_control/views.py, the parent_id branch resolved the parent report and constructed the IAM context but never called self.check_object_permissions(self.request, parent_report). Additionally, cvat/apps/quality_control/permissions.py built the IAM context with a None object reference instead of the resolved report, bypassing scoped authorization logic.

Attack Vector

Exploitation requires only a low-privilege authenticated session. An attacker iterates integer values in the parent_id query parameter and classifies responses: HTTP 500 indicates existence with access failure, while HTTP 404 indicates a non-existent identifier. Repeating this across the identifier range enumerates cross-organization reports.

python

# Security patch: cvat/apps/quality_control/views.py
# NOTE: the parent_id filter requires a different queryset
if parent_id := self.request.query_params.get("parent_id", None):
    parent_report = get_or_404(QualityReport, parent_id)
    self.check_object_permissions(self.request, parent_report)
    iam_context = get_iam_context(self.request, parent_report)

    # For m2m relations this is actually "in"

Source: GitHub Commit 27953f1

python

# Security patch: cvat/apps/quality_control/permissions.py
report = get_or_404(QualityReport, report)

if not iam_context and request:
    iam_context = get_iam_context(request, report)

return cls(**iam_context, scope=cls.Scopes.VIEW, obj=report)

Source: GitHub Commit 27953f1

The patch adds the missing check_object_permissions call and passes the resolved report object rather than None to get_iam_context.

Detection Methods for CVE-2026-58373

Indicators of Compromise

Repeated authenticated GET /api/quality/reports?parent_id=<n> requests with sequential or randomized integer values from the same session or API token.
Elevated volumes of HTTP 500 and HTTP 404 responses from the /api/quality/reports endpoint tied to a single user or IP.
Requests to the quality reports endpoint originating from user sessions whose organization membership does not overlap with the requested parent_id owner.

Detection Strategies

Alert on session-level request patterns that iterate parent_id values across a wide identifier range in short time windows.
Correlate HTTP status code distribution per user; a spike in 500 responses from a single principal indicates enumeration.
Compare the tenant owning the requested parent_id against the authenticated user's organization and flag mismatches.

Monitoring Recommendations

Enable structured access logging on the CVAT API gateway with organization identifiers, response codes, and query parameters recorded.
Ship API access logs to a centralized analytics platform and build dashboards for per-endpoint enumeration behavior.
Set thresholds on parent_id request cardinality per user session and trigger security review when exceeded.

How to Mitigate CVE-2026-58373

Immediate Actions Required

Upgrade CVAT to version 2.69.0 or later, which contains the fix in commit 27953f1.
Audit historical access logs for enumeration patterns against /api/quality/reports and identify accounts that queried parent_id values outside their organization scope.
Rotate API tokens for accounts that exhibit suspicious enumeration behavior.

Patch Information

The fix is delivered in CVAT release v2.69.0 and originates from Pull Request #10807. Technical background is documented in the VulnCheck Security Advisory. The patch adds self.check_object_permissions(self.request, parent_report) to the viewset and corrects the permissions helper to pass the resolved report object into get_iam_context.

Workarounds

Restrict access to the /api/quality/reports endpoint via reverse proxy or WAF rules until upgrade is possible.
Limit account creation and require organization scoping so only trusted users hold authenticated sessions on shared CVAT instances.
Deploy rate limiting on the quality reports endpoint to slow identifier enumeration attempts.

bash

# Example nginx rate limit for the quality reports endpoint
limit_req_zone $binary_remote_addr zone=cvat_quality:10m rate=10r/m;

location /api/quality/reports {
    limit_req zone=cvat_quality burst=5 nodelay;
    proxy_pass http://cvat_backend;
}