CVE-2026-23526

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23526", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.980Z", "datePublished": "2026-01-21T21:40:25.214Z", "dateUpdated": "2026-02-26T14:44:33.583Z"}, "containers": {"cna": {"title": "CVAT vulnerable to privilege escalation of users with staff status", "problemTypes": [{"descriptions": [{"cweId": "CWE-267", "lang": "en", "description": "CWE-267: Privilege Defined With Unsafe Actions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7"}, {"name": "https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4", "tags": ["x_refsource_MISC"], "url": "https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4"}], "affected": [{"vendor": "cvat-ai", "product": "cvat", "versions": [{"version": ">= 1.0.0, < 2.55.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:40:25.214Z"}, "descriptions": [{"lang": "en", "value": "CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges."}], "source": {"advisory": "GHSA-7pvv-w55f-qmw7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T04:55:22.871192Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:33.583Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T04:55:22.871192Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:09:32.221Z"}}], "cna": {"title": "CVAT vulnerable to privilege escalation of users with staff status", "source": {"advisory": "GHSA-7pvv-w55f-qmw7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cvat-ai", "product": "cvat", "versions": [{"status": "affected", "version": ">= 1.0.0, < 2.55.0"}]}], "references": [{"url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7", "name": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4", "name": "https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-267", "description": "CWE-267: Privilege Defined With Unsafe Actions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:40:25.214Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23526", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:33.583Z", "dateReserved": "2026-01-13T18:22:43.980Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T21:40:25.214Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cvat", "vendor": "cvat-ai", "versions": [{"status": "affected", "version": ">= 1.0.0, < 2.55.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cvat:computer_vision_annotation_tool:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B280485-FCFA-441E-AFDD-E1F65EAB5131", "versionEndExcluding": "2.55.0", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges."}, {"lang": "es", "value": "CVAT es una herramienta de anotaci\u00f3n interactiva de v\u00eddeo e imagen de c\u00f3digo abierto para visi\u00f3n por computadora. En las versiones 1.0.0 a 2.54.0, los usuarios que tienen el estado de personal pueden cambiar libremente sus permisos, incluyendo otorgarse a s\u00ed mismos el estado de superusuario y unirse al grupo de administradores, lo que les da acceso completo a los datos en la instancia de CVAT. La versi\u00f3n 2.55.0 corrige el problema. Como soluci\u00f3n alternativa, revise la lista de usuarios con estado de personal y rev\u00f3quelo a cualquier usuario que no se espere que tenga privilegios de superusuario."}], "id": "CVE-2026-23526", "lastModified": "2026-06-17T10:21:43.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23526", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T04:55:22.871192Z", "version": "2.0.3"}}]}, "published": "2026-01-21T22:15:50.433", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-267"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:08:35.437271+00:00", "value": {"mitigation_remediation": ["Upgrade CVAT to version 2.55.0 or later to eliminate the privilege escalation flaw", "If an upgrade is not immediately possible, revoke staff status from all users who do not require that role and monitor the user list for any unexpected changes", "Restrict the assignment of staff status to only trusted administrators and enforce least\u2011privilege principles for all other users"], "summary": {"action": "Patch Update", "impact": "Privilege Escalation to Superuser"}, "threat_synthesis": {"affected_systems": "The vulnerability is confined to the open\u2011source Computer Vision Annotation Tool (CVAT) manufactured by cvat\u2011ai. All releases from 1.0.0 up to and including 2.54.0 are affected; version 2.55.0 and later contain the fix.", "description_and_impact": "In CVAT versions 1.0.0 through 2.54.0 a staff\u2011level user is permitted to change the permissions of any account, including granting themselves superuser rights and adding themselves to the administrator group. This flaw allows an authorized staff member to gain unrestricted access to all data stored in the CVAT instance, effectively making the entire system vulnerable to data theft, modification, or deletion. The weakness corresponds to improper user role validation (CWE\u2011267).", "risk_and_exploitability": "The CVSS score of 8.5 classifies this as a high\u2011severity issue, but the EPSS score is below 1%, indicating a very low probability of exploitation at the time of analysis and no listing in the CISA KEV catalogue. Exploitation requires an attacker to possess a staff account or to create one by compromising an existing staff account. Once in that role, the attack path is straightforward: the compromised user can immediately elevate privileges without further external interaction. The attack vector is therefore inferred as an authenticated privilege\u2011escalation scenario rather than a remote code execution or network\u2011level exploit."}}}}, "created": "2026-01-22T10:08:19.300881+00:00", "updated": "2026-04-18T04:15:05.874667+00:00", "vendors": ["cvat-ai", "cvat-ai$PRODUCT$cvat"]}