{"data":{"id":"ffd305c0-c87c-4ebb-9abc-d1776827679b","title":"CVE-2026-82834: A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto…","summary":"A security flaw in Doccano, an open source annotation tool for machine learning practitioners, affects versions up to 1.8.5. The issue sits in the LabelList function of the Bulk-Delete Endpoint, reached through /v1/projects/1/category-types, and manipulating it results in improper access controls. The attack can be run remotely, and a public exploit has been released.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82834","publishedAt":"2026-08-31T20:17:15.510Z","cveId":"CVE-2026-82834","cweIds":["CWE-266","CWE-284"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Doccano"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Doccano improper access controls in LabelList bulk-delete endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00381,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":["GHSA-4x76-v872-9qwj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T18:08:50.943Z","patchAvailable":null,"disclosureDate":"2026-08-31T20:17:15.510Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}