CVE-2026-2109mediumCWE-266CWE-285

CVE-2026-2109: medium-severity vulnerability in jsbroks COCO Annotator

jsbroks COCO Annotator Delete Category undo improper authorization

Published · Updated

Follow this CVE+ Monitor COCO Annotator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category Handler. Such manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
jsbroks · COCO Annotator
Related CVEs — jsbroks COCO Annotator

In the same product, most dangerous first.

CVE-2024-10141MEDIUMjsbroks COCO Annotator Session predictable stateEPSS 0.8%CVE-2026-2108MEDIUMjsbroks COCO Annotator Endpoint long_task denial of serviceEPSS 0.8%CVE-2026-7680MEDIUMjsbroks COCO Annotator Data Endpoint datasets.py path traversalEPSS 0.5%CVE-2026-7681MEDIUMjsbroks COCO Annotator Dataset API datasets.py authorizationEPSS 0.5%