CVE-2026-82833: Improper Access Controls in Doccano Open Source Annotation Tools for Machine Learning Practitioners

This vulnerability affects the ExampleDetail function of the /v1/projects/1/examples/ endpoint in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module up to version 1.8.5. It allows improper access control, potentially enabling unauthorized access or manipulation of project example details. The attack vector is remote with no privileges required, and user interaction is not needed. The vendor was contacted but did not provide any response or patch. Exploit code is publicly available, increasing the risk of exploitation.

The improper access control flaw could allow an attacker to access or manipulate project example details without proper authorization. This could lead to unauthorized data exposure or modification within the annotation tool environment. The CVSS 4.0 score of 5.3 reflects a medium severity impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting network access to the affected endpoint and monitor for suspicious activity. Applying custom access control measures or disabling the vulnerable endpoint until a patch is released may reduce risk.