CVE-2026-73219
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
CVAT is an open source interactive video and image annotation tool. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request with inconsistent task and job IDs, blocking automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
Risk Assessment
The vulnerability can disrupt teams using automatic annotation, impacting productivity and project timelines.
Recommendation
It is recommended to update CVAT to version 2.72.0 or later and restrict write access to jobs to reduce the risk of exploitation.
Original NVD description (English source)
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.