CyberRota Analysis
AI-GeneratedLabel Studio's proxy_api.py endpoints are vulnerable due to inadequate organization filters, allowing attackers to access unauthorized cloud storage objects by creating separate organizations and manipulating file URIs. This could lead to data exposure across different tenants, posing a significant risk to sensitive information. Organizations using Label Studio should prioritize addressing this vulnerability to protect their data integrity and confidentiality.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.