CVE-2026-7681

🗓️ 03 May 2026 05:00:14Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 19 Views🌐 WEB

Security flaw in jsbroks COCO Annotator up to 0.11.1 enables remote authorization bypass via DatasetId.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-7681	3 May 202605:00	–	attackerkb
CNNVD	COCO Annotator 授权问题漏洞	3 May 202600:00	–	cnnvd
Cvelist	CVE-2026-7681 jsbroks COCO Annotator Dataset API datasets.py authorization	3 May 202605:00	–	cvelist
EUVD	EUVD-2026-26817	3 May 202605:00	–	euvd
NVD	CVE-2026-7681	3 May 202606:15	–	nvd
Positive Technologies	PT-2026-36683	3 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-7681	5 May 202602:20	–	redhatcve
Vulnrichment	CVE-2026-7681 jsbroks COCO Annotator Dataset API datasets.py authorization	3 May 202605:00	–	vulnrichment

Vulners

Node

jsbroks coco_annotatorMatch0.11.0

jsbroks coco_annotatorMatch0.11.1

[
  {
    "vendor": "jsbroks",
    "product": "COCO Annotator",
    "versions": [
      {
        "version": "0.11.0",
        "status": "affected"
      },
      {
        "version": "0.11.1",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:jsbroks:coco_annotator:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Dataset API"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/360834/cti
github	www.github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Unauthenticated%20Dataset%20Modification%20via%20Missing%20Authentication
vuldb	www.vuldb.com/submit/801408
vuldb	www.vuldb.com/vuln/360834

Parameter	Position	Path	Description	CWE
DatasetId	path	backend/webserver/api/datasets.py	Authorization bypass via manipulation of DatasetId in Dataset API.	CWE-639, CWE-285

17 Jun 2026 11:02Current

6.2Medium risk

Vulners AI Score6.2

CVSS 26.4

CVSS 3.16.5

CVSS 46.9

CVSS 36.5

EPSS0.00455

SSVC