CVE-2026-85211

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints.

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.

3. Sep 2026

Ausgewertete Quellen

• NVD
  CVE-2026-85211