Defenders should note that this vulnerability allows a malicious actor to circumvent multitenancy isolation. By creating a separate organization within a shared instance, an attacker can supply arbitrary file URIs to the system. The application then inadvertently allows the attacker to presign or stream bucket contents that they are not authorized to access. This leads to unauthorized data access and potential exfiltration of sensitive cloud storage objects across tenant boundaries. The vulnerability has a CVSS v3.1 base score of 7.7, reflecting the high impact on data confidentiality in multi-tenant cloud deployments.

Impact

Successful exploitation allows unauthorized users to access cloud storage assets belonging to other tenants. This compromises data isolation within multi-tenant Label Studio environments, potentially exposing sensitive datasets, project artifacts, or private cloud storage resources. The number of impacted organizations depends on the prevalence of multi-tenant, cloud-connected deployments of Label Studio.

Recommendation

Prioritized actions for security teams:

• Verify your Label Studio instance configuration for multi-tenancy and restrict public or cross-organization storage URI access until a vendor-supplied patch is applied.
• Review access logs for proxy_api.py endpoints to identify anomalous requests targeting storage URIs that do not belong to the requesting user's organization.
• Monitor for unauthorized cross-tenant data access patterns in cloud storage provider logs (e.g., S3, GCS) originating from the Label Studio server identity.