VulnerabilityReceived

CVE-2026-73652

In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review.

HIGH 7.1EPSS 0.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.

CVSS 4.0: 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-863
Source: security-advisories@github.com

References

https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.