CVE-2026-58373: CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence
CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.getqueryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing checkobjectpermissions call on the parentid query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parentid values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58373?
The severity of CVE-2026-58373 is rated as medium with a score of 4.3.
How do I fix CVE-2026-58373?
To fix CVE-2026-58373, update your CVAT software to version 2.69.0 or later.
What does CVE-2026-58373 exploit?
CVE-2026-58373 exploits a missing authorization check on the parent_id filter, allowing attackers to view reports from other organizations.
Who is affected by CVE-2026-58373?
Authenticated users of CVAT versions prior to 2.69.0 are affected by CVE-2026-58373.
What types of attacks can CVE-2026-58373 enable?
CVE-2026-58373 can enable attackers to enumerate quality report identifiers from other organizations.