CVE-2026-76073: Label Studio: IDOR exposes cross-org annotations

HIGHPoC AVAILABLE

Published August 24, 2026

CISO Take

Label Studio's AnnotationAPI and AnnotationConvertAPI endpoints skip the organization-scoping check that the sibling task endpoint enforces, so any authenticated user on a multi-tenant instance can read, edit, or delete annotations belonging to other organizations simply by guessing sequential integer IDs. This matters because Label Studio sits at the heart of human-in-the-loop labeling for training pipelines, so an attacker with nothing more than a valid low-privilege account (PR:L, no user interaction, CVSS 8.8) can exfiltrate proprietary labeled datasets or silently corrupt ground-truth labels feeding a downstream model. There's no CISA KEV listing, no public exploit code, and no EPSS score yet, but the bug requires zero AI-specific skill to abuse — it's a textbook IDOR that any script-kiddie with an authenticated session can walk. No patched version is published yet, so the near-term priority is isolating or restricting multi-org Label Studio instances rather than waiting on a fix. Track HumanSignal/label-studio issue #9796 for the patch and audit AnnotationAPI access logs now for sequential ID enumeration patterns.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High risk despite the absence of active exploitation evidence. The flaw is trivially exploitable (AC:L, PR:L, UI:N) by any authenticated user, requires no specialized tooling, and yields full read/write/delete impact (C:H/I:H/A:H) on data belonging to other tenants. The primary mitigating factor is that exploitation requires network access to a specific self-hosted or multi-tenant Label Studio deployment and a valid low-privilege account on it — this is not a pre-auth internet-wide sweep. However, given Label Studio's role as a shared annotation platform (often multi-tenant in agencies, MLOps vendors, or internal data-labeling teams), the blast radius per vulnerable instance can be large, and the lack of a patched version extends the exposure window indefinitely until HumanSignal ships a fix.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a legitimate low-privilege authenticated account on a shared/multi-tenant Label Studio instance.

AML.T0012

Enumeration

Attacker iterates sequential integer annotation IDs against the AnnotationAPI/AnnotationConvertAPI endpoints to discover annotations outside their own organization.

AML.T0036

Exploitation

Because the view's queryset and permission checks only verify authentication (not organization ownership), the attacker's GET/PATCH/DELETE requests succeed against another organization's annotations.

AML.T0049

Impact

Attacker exfiltrates proprietary labeled data, tampers with ground-truth labels that later train a model, or deletes annotations to disrupt a competitor's or partner's labeling pipeline.

AML.T0020

Initial Access

Attacker obtains or already holds a legitimate low-privilege authenticated account on a shared/multi-tenant Label Studio instance.

AML.T0012

Enumeration

Attacker iterates sequential integer annotation IDs against the AnnotationAPI/AnnotationConvertAPI endpoints to discover annotations outside their own organization.

AML.T0036

Exploitation

Because the view's queryset and permission checks only verify authentication (not organization ownership), the attacker's GET/PATCH/DELETE requests succeed against another organization's annotations.

AML.T0049

Impact

Attacker exfiltrates proprietary labeled data, tampers with ground-truth labels that later train a model, or deletes annotations to disrupt a competitor's or partner's labeling pipeline.

AML.T0020

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Label Studio	pip	—	No patch
28.6K2 dependentsPushed yesterday50% patched~275d to patchFull package profile →

Do you use Label Studio? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

No patched version is published yet (references point to GitHub issue #9796, still open) — track that issue for the fix. Interim mitigations: (1) if Label Studio is multi-tenant, segment organizations onto separate instances/containers until patched, since the vulnerability only matters when multiple orgs share one instance; (2) add an org-ownership check at a reverse proxy or WAF layer for /api/annotations/<id> and the AnnotationConvertAPI equivalent, rejecting requests where the annotation's project organization doesn't match the session's active org (mirrors the fix the task endpoint already has); (3) audit access logs for sequential/incrementing ID access patterns across the AnnotationAPI/AnnotationConvertAPI routes as a detection signal; (4) tighten who gets any authenticated account on shared instances, since PR:L is the only barrier; (5) once patched, verify the fix by confirming get_queryset on both views filters by project__organization as the task endpoint does.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageModel PoisoningTraining DataAPIAML.T0020- Poison Training Data AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0059- Erode Dataset Integrity

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10-Data and data governance

ISO 42001

A.7.2-Data for AI systems

NIST AI RMF

MAP 2.3-Data provenance and quality are tracked and documented

OWASP LLM Top 10

LLM03-Training Data Poisoning

Frequently Asked Questions

What is CVE-2026-76073?

Is CVE-2026-76073 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-76073, increasing the risk of exploitation.

How to fix CVE-2026-76073?

No patched version is published yet (references point to GitHub issue #9796, still open) — track that issue for the fix. Interim mitigations: (1) if Label Studio is multi-tenant, segment organizations onto separate instances/containers until patched, since the vulnerability only matters when multiple orgs share one instance; (2) add an org-ownership check at a reverse proxy or WAF layer for `/api/annotations/<id>` and the AnnotationConvertAPI equivalent, rejecting requests where the annotation's project organization doesn't match the session's active org (mirrors the fix the task endpoint already has); (3) audit access logs for sequential/incrementing ID access patterns across the AnnotationAPI/AnnotationConvertAPI routes as a detection signal; (4) tighten who gets any authenticated account on shared instances, since PR:L is the only barrier; (5) once patched, verify the fix by confirming `get_queryset` on both views filters by `project__organization` as the task endpoint does.

What systems are affected by CVE-2026-76073?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data labeling/annotation workflows, human-in-the-loop ML pipelines.

What is the CVSS score for CVE-2026-76073?

CVE-2026-76073 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata labeling/annotation workflowshuman-in-the-loop ML pipelines

MITRE ATLAS Techniques

AML.T0020Poison Training Data

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0059Erode Dataset Integrity

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.7.2

NIST AI RMF: MAP 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.

Exploitation Scenario

An attacker with a low-privilege, legitimately-issued account in Organization A on a shared Label Studio instance notices that annotation detail URLs use small sequential integers (e.g., `/api/annotations/1042`). They script a loop incrementing the ID and calling GET on each, capturing any response that returns HTTP 200 rather than 403/404 — these belong to other organizations' projects, including Organization B's proprietary labeled dataset. Having confirmed access, the attacker escalates from passive reading to active tampering: PATCH requests silently flip labels on a subset of Organization B's annotations (e.g., relabeling malicious samples as benign in a security-classification training set), and DELETE requests remove others to disrupt Organization B's labeling progress. Because the endpoint returns normal success responses and no cross-org boundary check fires, Organization B has no immediate signal that its training data has been read, poisoned, or destroyed until model quality degrades or an audit surfaces the discrepancy.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.