CVE-2026-2109
Published: 07 February 2026
Summary
CVE-2026-2109 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Jsbroks Coco Annotator. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-2109 is an improper authorization vulnerability in jsbroks COCO Annotator versions up to 0.11.1. It affects an unknown function within the /api/undo/ endpoint of the Delete Category Handler component, where manipulation of the ID argument enables unauthorized actions. The issue is classified under CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization), with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Remote attackers with low privileges, such as authenticated users, can exploit this vulnerability over the network with low complexity and no user interaction required. Exploitation allows limited impacts on integrity and availability, potentially enabling unauthorized deletions or modifications via the undo mechanism, though confidentiality remains unaffected.
Advisories from VulDB detail the issue and reference a public exploit in a GitHub vulnerability research repository. The vendor was contacted early regarding disclosure but provided no response, and no patches or official mitigations are available.
The exploit is publicly available and might be used in attacks. The vulnerability was published on 2026-02-07.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5718
Vulnerability details
A vulnerability was identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file /api/undo/ of the component Delete Category Handler. Such manipulation of the argument ID leads to improper authorization. The attack may be…
more
launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authorization (CWE-266/285) on authenticated API endpoint enables privilege escalation via ID manipulation for unauthorized deletions; public web app exposure supports remote exploitation of public-facing service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization checks on the ID argument at /api/undo/ so that only permitted users can invoke Delete Category actions.
Requires that every authenticated user operate with the minimal privileges needed, eliminating the incorrect privilege assignment that lets low-privileged accounts delete categories via undo.
Ensures access-control decisions are made and enforced at the policy decision point before the undo handler processes the supplied ID.