CVE-2026-73219

Published: Ago 11, 2026 Last Modified: Ago 11, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.

1288

Improper Validation of Consistency within Input

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b…
https://github.com/cvat-ai/cvat/commit/20a1076a0b9de47e067b121e40f16d66d373b3f7
https://github.com/cvat-ai/cvat/pull/10964
https://github.com/cvat-ai/cvat/pull/10964
https://github.com/cvat-ai/cvat/releases/tag/v2.72.0
https://github.com/cvat-ai/cvat/releases/tag/v2.72.0
https://github.com/cvat-ai/cvat/security/advisories/GHSA-7x…
https://github.com/cvat-ai/cvat/security/advisories/GHSA-7xhx-3q27-xvcx