CVE-2026-76073 is a high-severity vulnerability in Label Studio, an open-source data annotation tool. The vulnerability arises from the AnnotationAPI in label_studio/tasks/api.py, which does not properly scope annotations to the requesting user's organization. This allows an authenticated user of one organization to enumerate and access annotations belonging to other organizations on the same instance. Th [truncated]
A server-side request forgery vulnerability exists in HumanSignal Label Studio through 1.24.0.dev0. The import-from-URL endpoint can fetch any caller-supplied URL, including internal loopback addresses, on the default installation. This allows an authenticated user to reach internal services, cloud metadata endpoints, and other resources not intended for external access because SSRF_PROTECTION_ENABLED is [truncated]
