Executive brief
Label Studio is a data labeling and annotation platform used by teams to prepare training data. A flaw in the annotation API allows any authenticated user to read, modify, and delete annotations from other organizations on the same instance by directly accessing annotation identifiers, bypassing intended organizational access controls.
Technical details
The AnnotationAPI and AnnotationConvertAPI views in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) with no get_queryset override, and rely on permission checks that authenticate users but do not enforce object-level organization boundaries. Permission checks (annotations.view, annotations.change, annotations.delete) are registered with rules.is_authenticated in label_studio/core/permissions.py, allowing any logged-in account to pass. Because annotation primary keys are sequential integers, an attacker can enumerate identifiers to access annotations belonging to other organizations. The sibling task endpoint correctly constrains its queryset to the requester's active organization; the annotation endpoint omits this boundary.
Affected products
- HumanSignal Label Studio 1.23.0 and earlier
Timeline
- 2026-08-24: disclosed
- other: CVE-2026-76073 assigned