3 minutes
CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint
⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.
🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2109%20-%20COCO%20Annotator%20-%20Broken%20Function%20Level%20Authorization%20in%20Undo%20Endpoint
📋 CVE record: CVE-2026-2109
Advisory Information
| Researcher | Natan Morette on behalf of Thoropass |
| Product | COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format. |
| Affected Version | 0.11.1 |
| Endpoint | /api/undo/ |
| Vulnerability Type | CWE-285: Improper Authorization (Broken Function Level Authorization) |
| CVE ID | CVE-2026-2109 |
Vulnerability Summary
An attacker can delete categories created by other users via a DELETE request to the /api/undo/ endpoint without any ownership or permission checks. This constitutes a Broken Function Level Authorization (BFLA) vulnerability, allowing unauthorized manipulation of protected resources.
Technical Analysis
➤ Vulnerable Endpoint: /api/undo/
➤ Parameter: ?id=
➤ Authentication: any authenticated user. No ownership or role check is performed before the delete executes, so a non-admin user can delete categories owned by others.
Proof of Concept
1. Create a new category with a user with admin privileges:
2. Then, with another non-admin user, send a request to delete the category; in this case, the admin created the category with ID 200.
Request to view the ID 200 category failed because users can only see their own category.
3. Send a DELETE request to the endpoint /api/undo to delete the ID 200 category:
4. Note the application accepts the request without validating that the user has permission to delete this category.
An attacker can exploit this vulnerability to delete all categories within the application.
Checking all categories before the attack
Executing the attack to delete category IDs ranging from 1 to 200
Checking the results returned a Status 200 with a success message. A normal user was able to delete all categories in the application
Confirm that the application currently has no categories after the attack
Impact
- Any authenticated user can delete categories created by other users.
- No verification is done to ensure that the requester is the original creator or has elevated permissions (e.g., admin).
- Leads to data integrity issues, potential denial of service, or abuse in multi-tenant environments.
Remediation
Enforce a server-side authorization check on the /api/undo/ handler that ties the delete action to the authenticated user, verifying ownership of the target resource (or an explicit admin role) before the deletion executes.
References
⚠️ Disclaimer
The vulnerability was identified through authorized security testing. The proof of concept is provided to help defenders validate their exposure and verify remediation.
Thoropass follows coordinated vulnerability disclosure (CVD) principles. Vulnerabilities are reported privately to maintainers, reasonable time is provided for remediation, and public advisories are released after coordination or fix availability.
About Thoropass
Thoropass delivers enterprise-grade audits with AI-native speed and precision. Designed from day one to integrate auditors, automation, and infosec workflows in a single, closed-loop system, no add-ons, no handoffs.
Our experienced penetration testing team proactively discovers vulnerabilities in web applications, APIs, and infrastructure — helping organizations secure their systems before attackers find weaknesses.