Improper Access Control in vantage6

MEDIUM 4.3CVE-2023-41882 · GHSA-gc57-xhh5-m94r · PYSEC-2023-201 · Published 11/10/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
vantage6 PyPI	`< 4.0.0`	`4.0.0`
vantage6 vantage6	`< 4.0.0`	`4.0.0`

Description

Impact

The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, currently it is only checked if the user has permission to view the collaboration.

Patches

Workarounds

None

References

None

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.

References

vantage6/vantage6 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-41882 · ADVISORY
vantage6/vantage6#711 · WEB
vantage6/vantage6 commit 86564e1 · WEB
pypa/advisory-database · WEB
vantage6/vantage6 · PACKAGE
vantage6/vantage6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free