CVE-2026-76073: Label Studio Auth Bypass Vulnerability

CVE-2026-76073 Overview

Label Studio contains an Insecure Direct Object Reference (IDOR) flaw in its annotation detail endpoint. The AnnotationAPI view in label_studio/tasks/api.py declares queryset = Annotation.objects.all() without a get_queryset override. Any authenticated user can retrieve, modify, or delete annotations belonging to other organizations on the same instance by supplying a sequential annotation identifier. The same unscoped queryset also appears on AnnotationConvertAPI. This weakness is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Any authenticated Label Studio user can read, modify, or delete annotations across organizational boundaries on the same instance, breaking tenant isolation for annotation data.

Affected Products

Label Studio (HumanSignal) — annotation detail endpoint in label_studio/tasks/api.py
Referenced source tree: Label Studio version 1.23.0
Deployments running multi-organization tenants on a shared instance

Discovery Timeline

2026-08-24 - CVE-2026-76073 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76073

Vulnerability Analysis

Label Studio exposes an annotation detail endpoint backed by the AnnotationAPI Django REST Framework view. The view sets queryset = Annotation.objects.all() and does not override get_queryset, so Django's default lookup returns any Annotation row matching the primary key in the URL. The sibling task endpoint correctly filters its queryset by project__organization against the requester's active organization, but the annotation path omits that boundary check.

Permission enforcement compounds the issue. The view declares permission_required entries for annotations.view, annotations.change, and annotations.delete. In label_studio/core/permissions.py, every permission is registered against rules.is_authenticated, which is satisfied by any logged-in account. No object-level organization test runs before the annotation is returned or mutated.

Root Cause

The root cause is a missing tenant scope in the queryset used for object retrieval. Because annotation identifiers are sequential integers, identifier enumeration is trivial. The authorization layer approves any authenticated principal, so the primary key alone determines access. The same unscoped pattern is present in AnnotationConvertAPI in the same file.

Attack Vector

An attacker with a valid low-privileged account on any organization in the target instance iterates annotation IDs against the AnnotationAPI detail route. GET requests disclose annotation content, PATCH/PUT modify labels, and DELETE removes annotations belonging to other tenants. No user interaction is required beyond authenticating to the attacker's own organization.

No verified proof-of-concept code is published. For source-level context see the Label Studio 1.23.0 tasks/api.py and the VulnCheck advisory.

Detection Methods for CVE-2026-76073

Indicators of Compromise

Sequential, high-volume GET requests to /api/annotations/<id>/ from a single authenticated session enumerating annotation IDs.
PATCH, PUT, or DELETE operations against annotation IDs whose parent project belongs to a different organization than the requester's active organization.
Application audit records showing annotation reads or mutations by user accounts that have never accessed the parent project.

Detection Strategies

Correlate the authenticated user's active_organization with the project.organization_id of each annotation touched, and alert on mismatches.
Add rate and cardinality checks on annotation ID access per session to flag enumeration behavior.
Review web server and Django logs for bursts of 4xx-free responses across a monotonically increasing ID range on annotation routes.

Monitoring Recommendations

Enable verbose API logging for the AnnotationAPI and AnnotationConvertAPI routes and forward events to a centralized log store.
Track per-user annotation access baselines and alert on deviations that cross organizational boundaries.
Monitor for unexpected annotation deletions or label changes that lack a corresponding task view from the same user.

How to Mitigate CVE-2026-76073

Immediate Actions Required

Restrict Label Studio access to trusted users and revoke accounts that do not require annotation APIs until a patched build is deployed.
Apply an application-layer patch that overrides get_queryset on AnnotationAPI and AnnotationConvertAPI to filter by task__project__organization matching the requester's active organization.
Audit annotation access logs for cross-organization reads, modifications, or deletions since deployment.

Patch Information

No fixed version is listed in the NVD entry at publication. Track the upstream fix through the Label Studio repository and GitHub Issue #9796, and upgrade once a release addressing the unscoped queryset is available.

Workarounds

Deploy separate Label Studio instances per organization to eliminate shared-tenant exposure until a patch is applied.
Place the annotation endpoints behind a reverse proxy that enforces per-organization path allowlists or drops direct ID-based requests.
Rotate API tokens and reduce the number of authenticated accounts on shared instances to shrink the attack surface.

bash

# Example reverse proxy guardrail: block direct annotation ID access from untrusted networks
# nginx snippet - adjust allowlist to internal management ranges only
location ~ ^/api/annotations/[0-9]+/?$ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://label_studio_upstream;
}