| Package | Affected versions | Patched versions |
|---|
| vantage6 PyPI | ≤ 5.0.2
| No fix yet |
Description
Impact
Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.
Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review
Patches
No
Workarounds
No
NVD description
vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free