CVE-2026-82834: Doccano Open Source Annotation Tools for Machine Learning Practitioners Bulk-Delete Endpoint category-types LabelList access control
A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component Bulk-Delete Endpoint. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The vulnerability requires low-level privileges (PR:L). It is remotely exploitable over the network and does not require user interaction.
Which versions are known to be affected?
The affected component is reported as Doccano, including the Auto Labeling Pipeline Module, up to version 1.8.5. The issue involves the LabelList function at the /v1/projects/1/category-types bulk-delete endpoint.
Is exploitation likely to be practical?
A public exploit has been released, and the vulnerability is rated as having low attack complexity. Organizations running affected versions should treat authenticated remote misuse of the endpoint as a realistic risk.
What is the potential impact?
Successful exploitation can compromise integrity and availability at a low impact level. No confidentiality impact is indicated by the supplied severity vector.