CVE-2026-23526
📋 TL;DR
CVAT users with staff status can escalate their own privileges to superuser/admin level, gaining full access to all data in the CVAT instance. This affects all CVAT deployments running versions 1.0.0 through 2.54.0. The vulnerability allows unauthorized privilege escalation within the application.
💻 Affected Systems
- CVAT (Computer Vision Annotation Tool)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Staff users gain superuser privileges, allowing them to access, modify, or delete all annotation data, user accounts, and system configurations.
Likely Case
Staff users elevate their privileges to access sensitive annotation data they shouldn't have permission to view or modify.
If Mitigated
No impact if proper access controls prevent staff users from accessing privilege modification features.
🎯 Exploit Status
Exploitation requires authenticated staff user access. The vulnerability is in the user interface allowing self-privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.55.0
Vendor Advisory: https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7
Restart Required: Yes
Instructions:
1. Backup your CVAT data and configurations. 2. Update CVAT to version 2.55.0 or later using your deployment method (Docker, Kubernetes, etc.). 3. Restart the CVAT services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Review and revoke staff status
allReview all users with staff status and remove it from users who should not have superuser privileges.
# Review staff users in CVAT admin interface
# Remove staff status from unauthorized users
🧯 If You Can't Patch
- Implement strict access controls to prevent staff users from accessing privilege modification features
- Monitor user permission changes and audit logs for unauthorized privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check CVAT version via web interface or deployment configuration. Versions 1.0.0 through 2.54.0 are vulnerable.Check Version:
# For Docker deployments: docker exec cvat_server python manage.py --versionVerify Fix Applied:
After updating to 2.55.0+, verify that staff users can no longer modify their own permissions to gain superuser status.📡 Detection & Monitoring
Log Indicators:
- User permission changes from staff to superuser/admin
- Unauthorized access to admin functions by staff users
Network Indicators:
- HTTP requests to permission modification endpoints from staff user accounts
SIEM Query:
source="cvat" AND (event="permission_change" OR event="user_escalation")