CVE-2026-82834 Overview
CVE-2026-82834 is an improper access control vulnerability in Doccano, an open source annotation tool for machine learning practitioners and its Auto Labeling Pipeline module. The flaw affects versions up to 1.8.5 and resides in the LabelList function of the /v1/projects/1/category-types endpoint, part of the Bulk-Delete component. An authenticated remote attacker can manipulate the endpoint to bypass access controls [CWE-266]. The exploit has been publicly released. The vendor was contacted about this disclosure but did not respond.
Critical Impact
Authenticated remote attackers can abuse the Bulk-Delete endpoint to delete or modify category-type resources they should not be authorized to alter, resulting in limited integrity and availability impact.
Affected Products
- Doccano Open Source Annotation Tool up to version 1.8.5
- Doccano Auto Labeling Pipeline Module up to version 1.8.5
- Bulk-Delete Endpoint component (/v1/projects/1/category-types)
Discovery Timeline
- 2026-08-31 - CVE-2026-82834 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-82834
Vulnerability Analysis
The vulnerability exists in Doccano's project category-type management API. The LabelList handler serving the /v1/projects/1/category-types route implements the Bulk-Delete operation without enforcing sufficient authorization checks on the requesting user. An authenticated user with low privileges can send crafted requests to this endpoint and manipulate label resources tied to projects they do not own or should not administer.
Because Doccano is commonly deployed in shared annotation environments where multiple teams work on distinct projects, this class of flaw allows one tenant to interfere with another tenant's labeling schema. Deleted or altered category types can corrupt annotation datasets used to train downstream machine learning models.
The underlying weakness is classified as Improper Privilege Management [CWE-266]. The EPSS probability stands at 0.221% as of 2026-09-03, reflecting a low predicted exploitation likelihood despite public exploit availability.
Root Cause
The LabelList view in the Bulk-Delete Endpoint does not consistently validate that the caller has project-level permissions for the target category types before processing deletion requests. Access control decisions rely on authentication state alone rather than object-level authorization.
Attack Vector
Exploitation requires network access to the Doccano application and a valid low-privileged account. The attacker sends a Bulk-Delete request against /v1/projects/1/category-types referencing resources outside their permitted scope. No user interaction is required. Because the exploit has been published, opportunistic use against exposed Doccano instances is plausible.
Detailed exploitation code is not reproduced here. Refer to the VulDB entry for CVE-2026-82834 and VulDB Vulnerability #397246 for technical references.
Detection Methods for CVE-2026-82834
Indicators of Compromise
- Unexpected DELETE or bulk-delete HTTP requests targeting /v1/projects/<id>/category-types from user accounts outside the project's authorized member list.
- Sudden disappearance of category types or label definitions in annotation projects without a corresponding audit-log entry from a project administrator.
- Repeated 200-OK responses on category-type deletion endpoints originating from a single low-privileged session.
Detection Strategies
- Enable and centrally collect Doccano application logs, then alert on category-type deletion events where the actor's role does not match the target project's membership.
- Deploy a web application firewall or reverse-proxy rule set to log and rate-limit requests to /v1/projects/*/category-types endpoints.
- Correlate authentication telemetry with API access logs to identify horizontal privilege abuse patterns across project boundaries.
Monitoring Recommendations
- Establish baselines for normal category-type management activity per project and alert on deviations.
- Monitor for anomalous API request volume from non-administrative accounts against project management routes.
- Review Doccano user role assignments periodically to reduce the pool of accounts capable of reaching the vulnerable endpoint.
How to Mitigate CVE-2026-82834
Immediate Actions Required
- Restrict network exposure of Doccano instances to trusted networks or VPN users until a fix is validated.
- Audit existing Doccano user accounts and revoke unnecessary project memberships to limit blast radius.
- Enable verbose API logging on Doccano and forward logs to a centralized analytics platform for review.
Patch Information
At the time of publication, no vendor patch has been released. The vendor was reportedly contacted but did not respond to the disclosure. Monitor the Doccano project references on VulDB for updates, and track upstream Doccano releases beyond version 1.8.5 for any security fixes addressing the LabelList authorization logic.
Workarounds
- Place Doccano behind an authenticating reverse proxy that enforces project-scoped access rules for /v1/projects/*/category-types routes.
- Segregate annotation projects into separate Doccano deployments per team or tenant to prevent cross-project resource access.
- Apply a custom middleware or code patch that validates project membership and role before allowing the Bulk-Delete handler to execute.
- Take routine backups of annotation datasets and category-type configurations so that unauthorized deletions can be restored quickly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.