CVE-2026-76073

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

EUVD-2026-65060

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

PT-2026-80987

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label studio/tasks/api.py declares queryset = Annotation.objects.all and provides no get queryset override, so the default lookup retrieves any annotation by primary key. The view's...