Auth bypass in Cvat-ai Cvat

CVE-2025-49135

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the quer…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (41.8th percentile) — read the EPSS interpretation.

Affected products

Cvat-ai Cvat — versions >= 2.2.0, < 2.40.0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

https://github.com/cvat-ai/cvat/security/advisories/GHSA-frpr-5w6q-hh4f (x_refsource_CONFIRM)
https://github.com/cvat-ai/cvat/commit/dbafd9c0287489bea00e1db626f64b107f90bfc9 (x_refsource_MISC)