Description

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-03T15:17:40.257Z",
  "pubdate": "2026-09-03T15:17:40.257Z",
  "executiveSummary": "This vulnerability is an Insecure Direct Object Reference (IDOR) manifesting as a Cross-Tenant Information Disclosure within Label Studio. The issue resides in the proxy_api.py module, where the application fails to enforce organizational boundary checks when resolving and accessing cloud storage URIs.\nBy manipulating storage URI requests, an authenticated attacker belonging to one organization can access, presign, or stream sensitive data objects stored in the cloud buckets of other tenants.\nThis flaw effectively bypasses the multi-tenancy logical isolation enforced by the platform. The impact is significant, as it allows unauthorized access to private datasets, credentials, or proprietary media stored in integrated cloud storage backends.\nSuccessful exploitation requires the attacker to have an active account within the instance, but does not necessitate administrative privileges. No interaction from the victim organization is required once the attacker has crafted the malicious URI request.\nThe risk implication is severe, as it undermines the confidentiality of all data processed via Label Studio’s cloud storage integrations, potentially leading to widespread data breaches across multi-tenant deployments.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate validation logic within the proxy_api.py endpoints responsible for handling cloud storage interactions. Specifically, the application logic assumes that any URI submitted to these endpoints is inherently authorized if the requesting user possesses a valid session, failing to perform a secondary verification against the organization ID associated with the storage resource.\nIn a multi-tenant Label Studio environment, organizations are expected to operate in silos. When a user requests to access, stream, or presign an object via the proxy API, the backend should verify that the requested cloud storage resource (identified by the URI) belongs to the organization ID linked to the current user's session context. The vulnerable code path bypasses this check, allowing a 'Confused Deputy' scenario where the server performs an authorized request on behalf of a user to an unauthorized resource.\nThe attack flow proceeds as follows: First, an attacker authenticates to their own legitimate organization within the Label Studio instance. Second, the attacker identifies the API endpoints within proxy_api.py that process cloud storage URIs, such as those used for task visualization or data annotation. Third, the attacker supplies a crafted URI that points to a target resource owned by a different organization. Because the backend does not validate the relationship between the session's organization_id and the cloud storage resource's ownership, the application proceeds to resolve the URI.\nWhen the proxy_api.py endpoint executes, it interacts with the underlying cloud provider (e.g., AWS S3, Google Cloud Storage, or Azure Blob Storage). Because the server typically utilizes long-lived or broad-scoped cloud credentials to access these buckets, it successfully retrieves the object or generates a presigned URL for the attacker. The application then returns the sensitive content or the access link to the attacker's client.\nThis vulnerability allows an attacker to enumerate and exfiltrate objects by brute-forcing URI patterns or by leveraging known naming conventions of storage buckets across the platform. The exposure is limited only by the attacker's ability to guess or discover valid storage object paths. Post-exploitation, an attacker can maintain unauthorized access to intellectual property, PII (Personally Identifiable Information), or sensitive annotation datasets, resulting in a complete failure of the platform's multi-tenant isolation model."
}