CVE-2026-73221

CVAT (open source annotation tool) versions 2.17.0 through 2.72.0 suffer flawed authorization on lambda request endpoints (retrieve/destroy) where a Worker can view/cancel automatic annotation requests for tasks/jobs they should not access. Root cause: predictable task-based request IDs enabling ...