CVE-2026-2109

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2109

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2109.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2109

Published

2026-02-07T20:15:55.500Z

Modified

2026-03-13T03:55:57.036113Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category Handler. Such manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Git / github.com/jsbroks/coco-annotator

Affected ranges

Type

GIT

Repo

https://github.com/jsbroks/coco-annotator

Events

Introduced

Last affected

2c7b11b998e0ad577753ffd6d046267ba3c1c5f6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.11.1"
        }
    ]
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.11.0

v0.11.1

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.7.0

v0.7.1

v0.7.2

v0.8.0

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2109.json"