Broken Access Control on Natan Maia Morette

CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint

Sat, 07 Feb 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2109%20-%20COCO%20Annotator%20-%20Broken%20Function%20Level%20Authorization%20in%20Undo%20Endpoint
📋 CVE record: CVE-2026-2109

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/undo/`
Vulnerability Type	CWE-285: Improper Authorization (Broken Function Level Authorization)
CVE ID	CVE-2026-2109

Vulnerability Summary

An attacker can delete categories created by other users via a DELETE request to the /api/undo/ endpoint without any ownership or permission checks. This constitutes a Broken Function Level Authorization (BFLA) vulnerability, allowing unauthorized manipulation of protected resources.

CVE-2025-8789: Broken Function Level Authorization (BFLA) allows unauthorized users to alter student grades

Sun, 10 Aug 2025 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the CVE Hunters. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8789/
📋 CVE record: CVE-2025-8789

Summary

An API endpoint in i-Educar 2.9.0 is vulnerable to Broken Function Level Authorization (BFLA). An unauthorized user is able to modify student grades by directly accessing the /module/Api/Diario endpoint, bypassing permission controls. This leads to severe integrity issues, where anyone with access to the API format can tamper with academic records.

CVE-2025-8790: Broken Object Level Authorization (BOLA) in pessoa API Endpoint Allows Unauthorized Access to Other Users Data

Sun, 10 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8790/
📋 CVE record: CVE-2025-8790

Summary

A Broken Object Level Authorization (BOLA) vulnerability was identified in the i-educar 2.8 and 2.9 API, allowing any authenticated low-privileged user to access sensitive information from other users by manipulating the id parameter in the pessoa resource endpoint.

CVE-2024-57032: Broken Authentication - Old Password

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57032/
📋 CVE record: CVE-2024-57032

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57032

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-53473: Broken Access Control

Sat, 07 Dec 2024 00:00:00 -0300