PYSEC-2026-3703

vendorUSosv

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

view advisory published 2026-08-19Licence: CC-BY-4.0

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review ### Patches No ### Workarounds No

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-73652US	—OT elevated	0.35% (29th)	—	2026-08-13
vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-47w6-gwp4-w6vcADVISORY
https://github.com/vantage6/vantage6PACKAGE
https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vcWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-73652ADVISORY
https://pypi.org/project/vantage6PACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan