CVE-2026-2109

🗓️ 07 Feb 2026 19:32:06Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 11 Views🌐 WEB

CVE-2026-2109: jsbroks COCO Annotator Delete Category undo allows improper authorization remotely.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-2109	7 Feb 202619:32	–	attackerkb
CNNVD	COCO Annotator 授权问题漏洞	7 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2109 jsbroks COCO Annotator Delete Category undo improper authorization	7 Feb 202619:32	–	cvelist
EUVD	EUVD-2026-5718	7 Feb 202619:32	–	euvd
NVD	CVE-2026-2109	7 Feb 202620:15	–	nvd
Positive Technologies	PT-2026-6917	7 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2109	9 Feb 202601:33	–	redhatcve
Vulnrichment	CVE-2026-2109 jsbroks COCO Annotator Delete Category undo improper authorization	7 Feb 202619:32	–	vulnrichment

NVD

Vulners

Node

jsbroks coco_annotatorRange≤0.11.1

[
  {
    "vendor": "jsbroks",
    "product": "COCO Annotator",
    "versions": [
      {
        "version": "0.11.0",
        "status": "affected"
      },
      {
        "version": "0.11.1",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:jsbroks:coco_annotator:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Delete Category Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/nmmorette/vulnerability-research/blob/main/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo/BFLA%20COCO%20Annotator%20in%20DELETE%20api%20undo%202f1ef09b8736807aa1f7ede4b64fa35d.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
id	request body	/api/undo/	Manipulation of the ID parameter in the Delete Category Handler leads to improper authorization.	CWE-266, CWE-285

29 Apr 2026 01:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.4 - 8.1

CVSS 45.3

CVSS 25.5

CVSS 35.4

EPSS0.0002

SSVC