Executive Summary

CVE-2026-2109 is a Broken Function Level Authorization (BFLA) vulnerability in jsbroks COCO Annotator versions up to 0.11.1. It affects the Delete Category Handler component at the /api/undo/ endpoint. The flaw allows any authenticated user to delete categories created by other users without verifying ownership or permissions.

Specifically, a low-privilege user can send a DELETE request with a category ID parameter to remove categories belonging to others because there is no validation to ensure the requester is the original creator or has admin rights.

This vulnerability can be exploited remotely and a public proof-of-concept exploit is available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized deletion of categories created by other users, causing data integrity issues.

It can also result in denial of service by disrupting normal operations and abuse in multi-tenant environments where multiple users share the system.

Overall, it compromises the integrity and availability of the system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring and testing unauthorized DELETE requests to the /api/undo/ endpoint with parameters targeting category IDs. Specifically, an authenticated user issuing a DELETE request with the parameter instance=category and an id value that does not belong to them indicates exploitation attempts.'}, {'type': 'paragraph', 'content': 'A practical detection method is to attempt to delete a category created by another user using a command-line tool like curl to simulate the exploit:'}, {'type': 'list_item', 'content': 'curl -X DELETE -H "Authorization: Bearer <user_token>" "https://<target_host>/api/undo/?id=<category_id>&instance=category"'}, {'type': 'paragraph', 'content': 'If the request succeeds in deleting categories not owned by the authenticated user, it confirms the presence of the vulnerability.'}] [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Currently, there are no known official patches or vendor responses to address this vulnerability.

Immediate mitigation steps include restricting access to the affected /api/undo/ endpoint to trusted users only, implementing additional access control mechanisms at the network or application level, and monitoring for suspicious DELETE requests targeting categories.

Users are also advised to consider replacing the affected jsbroks COCO Annotator versions 0.11.0 and 0.11.1 with alternative software that does not have this vulnerability.

Useful 0 Not Useful 0