CVE-2026-82833: Doccano Open Source Annotation Tools for Machine Learning Practitioners Project Example Detail Endpoint examples ExampleDetail access control
A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component Project Example Detail Endpoint. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Doccano Open Source Annotation Tools for Machine Learning Practitioners and its Auto Labeling Pipeline Module are affected through version 1.8.5. The issue is in the Project Example Detail endpoint at /v1/projects/1/examples/.
What does an attacker need to exploit this issue?
The attack can be launched remotely with low attack complexity and requires low privileges. No user interaction is required, and public exploit availability has been reported.
What is the likely impact of successful exploitation?
The reported improper access control can result in low-impact compromise of confidentiality, integrity, and availability. The vulnerability has a medium severity score of 6.3.
Is a vendor fix or workaround available?
The available information does not identify a fixed version or workaround. It states that the vendor was contacted but did not respond.