CVE-2026-2109
Published: 07 February 2026
Summary
CVE-2026-2109 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Jsbroks Coco Annotator. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.
Ensures privileges are assigned only as necessary rather than incorrectly over-granted.
The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authorization (CWE-266/285) on authenticated API endpoint enables privilege escalation via ID manipulation for unauthorized deletions; public web app exposure supports remote exploitation of public-facing service.
NVD Description
A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category Handler. Such manipulation of the argument ID leads to improper authorization. The attack may be…
more
launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-2109 is an improper authorization vulnerability in jsbroks COCO Annotator versions up to 0.11.1. It affects an unknown function within the /api/undo/ endpoint of the Delete Category Handler component, where manipulation of the ID argument enables unauthorized actions. The issue is classified under CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization), with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Remote attackers with low privileges, such as authenticated users, can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation allows limited impacts on integrity and availability, potentially enabling unauthorized deletions or modifications via the undo mechanism, though confidentiality remains unaffected.
Advisories from VulDB detail the issue and reference a public exploit in a GitHub vulnerability research repository. The vendor was contacted early regarding disclosure but provided no response, and no patches or official mitigations are available.
The exploit is publicly available and might be used in attacks. The vulnerability was published on 2026-02-07.
Details
- CWE(s)