CVE-2026-2109
📋 TL;DR
This vulnerability allows unauthorized deletion of categories in jsbroks COCO Annotator through improper authorization in the Delete Category Handler. Attackers can remotely exploit this to manipulate annotation data. Users of COCO Annotator versions up to 0.11.1 are affected.
💻 Affected Systems
- jsbroks COCO Annotator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete loss or corruption of annotation categories, disrupting annotation workflows and potentially requiring data restoration from backups.
Likely Case
Unauthorized deletion of specific annotation categories, causing data inconsistency and requiring manual correction.
If Mitigated
Minimal impact with proper access controls and monitoring in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. Attack requires some authentication but bypasses authorization checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 0.11.1 if available, or implement workarounds.
🔧 Temporary Workarounds
API Endpoint Restriction
allBlock or restrict access to the vulnerable /api/undo/ endpoint
# Using web server configuration (nginx example)
location /api/undo/ { deny all; }
# Using firewall rules
iptables -A INPUT -p tcp --dport [COCO_PORT] -m string --string "/api/undo/" --algo bm -j DROP
Authentication Enhancement
allImplement additional authentication checks before category deletion operations
# Modify the Delete Category Handler to verify user permissions
# Check if current user has delete rights for the specified category ID
🧯 If You Can't Patch
- Implement network segmentation to restrict access to COCO Annotator to authorized users only
- Enable detailed logging of all category deletion operations and monitor for unauthorized attempts
🔍 How to Verify
Check if Vulnerable:
Check if your COCO Annotator version is 0.11.1 or earlier and if the /api/undo/ endpoint is accessible.Check Version:
Check the COCO Annotator web interface or configuration files for version informationVerify Fix Applied:
Test if unauthorized category deletion is possible through the /api/undo/ endpoint after implementing controls.📡 Detection & Monitoring
Log Indicators:
- Unusual DELETE requests to /api/undo/ endpoint
- Category deletion operations from unexpected users or IP addresses
Network Indicators:
- HTTP DELETE requests to /api/undo/ with category ID parameters
SIEM Query:
source="web_server_logs" AND (uri_path="/api/undo/" AND http_method="DELETE")