This vulnerability in jsbroks COCO Annotator (up to version 0.11.1) involves an authorization bypass in the Dataset API component. By manipulating the DatasetId parameter in the backend/webserver/api/datasets.py file, an attacker can remotely bypass authorization checks. The vendor has not provided any response or patch, and the vulnerability has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality and availability.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization controls in the Dataset API, potentially gaining unauthorized access to datasets or related functionality. The impact is rated medium, reflecting limited but meaningful unauthorized access without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is available, restrict access to the affected API endpoints and consider implementing additional access controls or network-level protections to limit exposure.