COCO Annotator on Natan Maia Morette

CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter

Sun, 03 May 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7680%20-%20COCO%20Annotator%20-%20Path%20Traversal%20via%20Dataset%20Folder%20Parameter
📋 CVE record: CVE-2026-7680

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetDataId` endpoint
Vulnerability Type	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
CVE ID	CVE-2026-7680

Vulnerability Summary

A path traversal vulnerability exists in the COCO Annotator dataset browsing API. The GET /api/dataset/<id>/data endpoint accepts a folder query parameter that is concatenated into a filesystem path without proper sanitization or containment validation.

CVE-2026-7681: COCO Annotator — Unauthenticated Dataset Modification via Missing Authentication

Sun, 03 May 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7681%20-%20COCO%20Annotator%20-%20Unauthenticated%20Dataset%20Modification%20via%20Missing%20Authentication
📋 CVE record: CVE-2026-7681

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetId` resource, `POST` method
Vulnerability Type	CWE-306: Missing Authentication for Critical Function
CVE ID	CVE-2026-7681

Vulnerability Summary

A missing authentication vulnerability exists in the COCO Annotator dataset management API. The POST /api/dataset/<id> endpoint, which updates a dataset’s categories and default annotation metadata, is missing the @login_required decorator. This allows any unauthenticated, anonymous attacker to modify any dataset in the system with a single HTTP request — no credentials, no session cookie, and no token required.

CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood

Sat, 07 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2108%20-%20COCO%20Annotator%20-%20Unauthenticated%20Denial%20of%20Service%20via%20Task%20Queue%20Flood
📋 CVE record: CVE-2026-2108

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/info/long_task`
Vulnerability Type	CWE-306: Missing Authentication for Critical Function; CWE-400: Uncontrolled Resource Consumption
CVE ID	CVE-2026-2108

Vulnerability Summary

The endpoint /api/info/long_task is exposed without authentication or rate limiting, and allows any remote user to enqueue Celery background tasks and write entries to the database (TaskModel) on every request.

CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint

Sat, 07 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2109%20-%20COCO%20Annotator%20-%20Broken%20Function%20Level%20Authorization%20in%20Undo%20Endpoint
📋 CVE record: CVE-2026-2109

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/undo/`
Vulnerability Type	CWE-285: Improper Authorization (Broken Function Level Authorization)
CVE ID	CVE-2026-2109

Vulnerability Summary

An attacker can delete categories created by other users via a DELETE request to the /api/undo/ endpoint without any ownership or permission checks. This constitutes a Broken Function Level Authorization (BFLA) vulnerability, allowing unauthorized manipulation of protected resources.