CVE-2026-46699 describes an improper access control vulnerability (CWE-284) in conda-smithy, a tool used by conda-forge to combine conda recipes with CI configurations. Before version 3.61.0, the conda-forge automated webservices relied on mutable GitHub usernames to route repository invitations. Because GitHub usernames can be changed, this allowed an attacker who took over a GitHub username to gain unintended write access to feedstock repositories. The vulnerability is resolved by switching to stable, immutable GitHub user IDs for invitation routing in version 3.61.0.

The vulnerability allows an attacker who gains control of a GitHub username to write to conda-forge feedstock repositories, potentially modifying repository contents. This could lead to integrity issues in the software supply chain. The CVSS score of 7.6 reflects a high severity with low attack complexity, no privileges required, but user interaction needed, and impacts on confidentiality, integrity, and availability.

Upgrade conda-smithy to version 3.61.0 or later, where the vulnerability is fixed by using immutable GitHub user IDs for invitation routing. No other mitigation is indicated. Patch status is confirmed by the vendor advisory stating the fix is in version 3.61.0.