CVE-2026-23526

The record

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges.

Affected packages

Related vulnerabilities

• CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility… CWE-267
• CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
• CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
• CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. CWE-267
• CVE-2026-18858 IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from… CWE-267
• CVE-2026-10090 A flaw was found in the Application Subscription controller… CWE-267
• CVE-2026-6816 An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the… CWE-267
• CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on… CWE-267