CVE-2023-43791

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.

• CWE-200

• https://github.com/HumanSignal/label-studio/commit/3d06c5131c15600621e08b06f07d976887cde81bPatch
• https://github.com/HumanSignal/label-studio/pull/4690Patch
• https://github.com/HumanSignal/label-studio/releases/tag/1.8.2Release Notes
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-f475-x83m-rx5mExploit, Vendor Advisory
• https://github.com/HumanSignal/label-studio/commit/3d06c5131c15600621e08b06f07d976887cde81bPatch
• https://github.com/HumanSignal/label-studio/pull/4690Patch
• https://github.com/HumanSignal/label-studio/releases/tag/1.8.2Release Notes
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-f475-x83m-rx5mExploit, Vendor Advisory

Published

Nov 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43786A vulnerability was found in libX11 due to an infinite loop …5.5
• CVE-2023-43787A vulnerability was found in libX11 due to an integer overfl…7.8
• CVE-2023-43788A vulnerability was found in libXpm due to a boundary condit…5.5
• CVE-2023-43789A vulnerability was found in libXpm where a vulnerability ex…5.5
• CVE-2023-4379An issue has been discovered in GitLab EE affecting all vers…7.5
• CVE-2023-43790iTop is an IT service management platform. By manipulating …5.4
• CVE-2023-43792baserCMS is a website development framework. In versions 4.6…9.8
• CVE-2023-43793Misskey is an open source, decentralized social media platfo…7.5
• CVE-2023-43794Nocodb is an open source Airtable alternative. Affected vers…4.9
• CVE-2023-43795GeoServer is an open source software server written in Java …9.8
• CVE-2023-43796Synapse is an open-source Matrix homeserver Prior to version…5.3
• CVE-2023-43797BigBlueButton is an open-source virtual classroom. Prior to …5.4