CVE-2026-82834: Improper Access Controls in Doccano Open Source Annotation Tools for Machine Learning Practitioners

This vulnerability affects Doccano versions 1.8.0 through 1.8.5 inclusive. The issue is located in the LabelList function of the Bulk-Delete Endpoint (/v1/projects/1/category-types), where improper access controls allow unauthorized remote manipulation. The flaw enables attackers with limited privileges to bypass intended access restrictions. Public exploit code exists, increasing the risk of exploitation. The vendor has not provided a response or patch, and no remediation level is indicated in the available data.

An attacker can remotely exploit this vulnerability to bypass access controls in the affected endpoint, potentially allowing unauthorized deletion or modification of category types in annotation projects. This could lead to unauthorized data manipulation within the Doccano platform. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting network access to the affected endpoints and monitoring for suspicious activity related to category-type deletions. Avoid exposing the vulnerable versions to untrusted networks until a fix is released.