CVE-2026-85211

Published: Sep 3, 2026Modified: Sep 3, 2026

8.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

https://github.com/HumanSignal/label-studio

Source: disclosure@vulncheck.com

https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/io_storages/proxy_api.py

Source: disclosure@vulncheck.com

https://github.com/HumanSignal/label-studio/issues/9924

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/label-studio-through-1.23.0-cross-organization-storage-uri-resolution

Source: disclosure@vulncheck.com

https://github.com/HumanSignal/label-studio/issues/9924

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.