CVE-2026-2109
Improper Authorization in jsbroks COCO Annotator Delete Handler
Publication date: 2026-02-07
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jsbroks | coco_annotator | to 0.11.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2109 is a Broken Function Level Authorization (BFLA) vulnerability in jsbroks COCO Annotator versions up to 0.11.1. It affects the Delete Category Handler component at the /api/undo/ endpoint. The flaw allows any authenticated user to delete categories created by other users without verifying ownership or permissions.
Specifically, a low-privilege user can send a DELETE request with a category ID parameter to remove categories belonging to others because there is no validation to ensure the requester is the original creator or has admin rights.
This vulnerability can be exploited remotely and a public proof-of-concept exploit is available.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized deletion of categories created by other users, causing data integrity issues.
It can also result in denial of service by disrupting normal operations and abuse in multi-tenant environments where multiple users share the system.
Overall, it compromises the integrity and availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring and testing unauthorized DELETE requests to the /api/undo/ endpoint with parameters targeting category IDs. Specifically, an authenticated user issuing a DELETE request with the parameter instance=category and an id value that does not belong to them indicates exploitation attempts.'}, {'type': 'paragraph', 'content': 'A practical detection method is to attempt to delete a category created by another user using a command-line tool like curl to simulate the exploit:'}, {'type': 'list_item', 'content': 'curl -X DELETE -H "Authorization: Bearer <user_token>" "https://<target_host>/api/undo/?id=<category_id>&instance=category"'}, {'type': 'paragraph', 'content': 'If the request succeeds in deleting categories not owned by the authenticated user, it confirms the presence of the vulnerability.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Currently, there are no known official patches or vendor responses to address this vulnerability.
Immediate mitigation steps include restricting access to the affected /api/undo/ endpoint to trusted users only, implementing additional access control mechanisms at the network or application level, and monitoring for suspicious DELETE requests targeting categories.
Users are also advised to consider replacing the affected jsbroks COCO Annotator versions 0.11.0 and 0.11.1 with alternative software that does not have this vulnerability.