GitHub Advisoryadvisory · PyPI

GHSA-47w6-gwp4-w6vc vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

HIGH Published 2026-07-24 Modified 2026-08-13 Official page ↗
Aliases
CVE-2026-73652
Ecosystem
PyPI
Packages
vantage6
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2026-07-24

Affected packages

• PyPI vantage6: <= 5.0.2 (no fix yet)

Description

Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No

Related

Alias · CVE (1)

  • CVE-2026-73652 vantage6 is an open-source infrastructure for privacy preserving analysis. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References