CVE-2026-85211

Label Studio does not enforce organization filters when resolving storage URIs for tasks and projects in the proxy_api.py endpoints, an authorization bypass flaw (CWE-639). An authenticated attacker can create a separate organization on the same deployment and supply arbitrary file URIs to the presign or streaming endpoints, causing the server to resolve and serve objects from other tenants' cloud storage buckets. This yields unauthorized read access to other organizations' cloud storage data (high confidentiality impact) without requiring user interaction, while integrity and availability are unaffected. Organizations running multi-organization Label Studio deployments — typically Enterprise or self-hosted multi-tenant setups — are affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Label Studio to the patched release identified in the HumanSignal advisory (specific fixed version is not stated in this data). Until patched, restrict access to the proxy_api.py presign/stream endpoints to trusted users, audit organization memberships on shared deployments, and consider network controls that limit who can create organizations. Operators of multi-tenant deployments should review logs for presign or stream requests referencing file URIs outside the requester's organization.