This vulnerability in jsbroks COCO Annotator (up to version 0.11.1) involves an authorization bypass caused by improper validation of the DatasetId parameter in the Dataset API (backend/webserver/api/datasets.py). An attacker can remotely manipulate this argument to gain unauthorized access to dataset resources. The vulnerability is publicly disclosed, but no official fix or patch has been released by the vendor. The CVSS 4.0 vector indicates it is remotely exploitable without privileges or user interaction, with low complexity and limited impact on confidentiality and availability.

Successful exploitation allows an unauthenticated remote attacker to bypass authorization controls and potentially access or manipulate datasets that should be restricted. This could lead to unauthorized data exposure or modification within the COCO Annotator environment. The impact is rated medium based on the CVSS score of 6.9. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future updates or patches. Until a fix is released, consider restricting network access to the affected API endpoints or implementing additional access controls at the network or application layer to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.