What is CVE-2026-23526?

CVE-2026-23526 is a high-severity vulnerability in Cvat Computer_vision_annotation_tool, classified under Privilege Defined With Unsafe Actions. CVSS score: 8.8/10. Published 2026-01-21.

How severe is CVE-2026-23526?

High severity. CVSS v3 base score is 8.8 out of 10.

Privilege escalation in Cvat Computer_vision_annotation_tool

CVE-2026-23526

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status an…

EPSS: 0.003 (17.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cvat Computer_vision_annotation_tool
Cvat-ai Cvat — versions >= 1.0.0, < 2.55.0

Weakness classification (CWE)

CWE-267 — Privilege Defined With Unsafe Actions

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-23526?: CVE-2026-23526 is a high-severity vulnerability in Cvat Computer_vision_annotation_tool, classified under Privilege Defined With Unsafe Actions. CVSS score: 8.8/10. Published 2026-01-21.
How severe is CVE-2026-23526?: High severity. CVSS v3 base score is 8.8 out of 10.