CVE-2026-58373 describes an improper authorization vulnerability in cvat-ai's CVAT product before version 2.69.0. The issue resides in the QualityReportViewSet.get_queryset function, where the absence of a check_object_permissions call on the parent_id query parameter enables authenticated attackers to enumerate quality report IDs belonging to other organizations. By sending requests with sequential integer parent_id values, attackers can distinguish existing reports from non-existing ones via HTTP 500 versus HTTP 404 responses. This vulnerability leaks the existence of cross-organization reports without exposing their content.

The vulnerability allows authenticated attackers to confirm the existence of quality reports belonging to other organizations by observing HTTP response differences. This leads to information disclosure about report identifiers across organizational boundaries. However, the actual content of the reports is not accessible, and there is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the quality reports API endpoint to trusted users only and monitor for unusual enumeration activity. Implement additional authorization checks on the parent_id parameter if possible.