CVE-2026-73221 CVAT: Flawed authorization logic in endpoints related to lambda requests
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-73221?
CVE-2026-73221 is a medium-severity vulnerability in cvat-ai cvat, published on 11 Aug 2026.
Official description
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-73221?
How do I fix CVE-2026-73221?
No fix has been published for CVE-2026-73221 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73221 being exploited?
There is no known exploitation of CVE-2026-73221 in the wild and no public exploit code.
Sources
Also known as GHSA-m7p7-6w4m-886p.