Most recent entries from all

EUVD-2026-352296

2026-10-05T13:43:46.972702+00:00

EUVD-2026-352296

fkie_cve-2026-73652

2026-10-05T13:43:46.972737+00:00

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.

GHSA-47w6-gwp4-w6vc — vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

2026-10-05T13:43:46.972770+00:00

Affected: PyPI: vantage6

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.

Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

### Patches No

### Workarounds No

PYSEC-2026-3703 — vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

2026-10-05T13:43:46.972800+00:00

Affected: PyPI: vantage6

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.

Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

### Patches No

### Workarounds No