An authorization bypass vulnerability in Label Studio allows authenticated users to access annotation details belonging to other organizations, threatening data confidentiality.

This is an authorization bypass flaw (CWE-639) where the application fails to validate the organization scope of the requesting user. An authenticated attacker (PR:L) can manipulate the annotation detail endpoint to access data they are not authorized to view.

This vulnerability directly compromises the confidentiality of proprietary data by allowing cross-organization data leakage. With a CVSS score of 8.8, the high severity reflects the risk of unauthorized exposure of sensitive annotation datasets, which could lead to severe reputational damage and loss of intellectual property.

Immediate Action: Monitor vendor communications for the release of a security patch and apply it as soon as it becomes available.

Proactive Monitoring: Audit access logs for unusual patterns of data retrieval from the annotation detail API, particularly requests that deviate from normal user behavior.

Compensating Controls: If a patch is not yet available, restrict access to the Label Studio instance to trusted internal networks and implement strict role-based access control policies to limit exposure.

Public Exploit Available: false

Organizations using Label Studio should exercise caution and restrict access to the application until a security update is released. Monitoring for unauthorized API access is essential to detect potential exploitation attempts until the underlying authorization mechanism is corrected by the vendor.