vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
Affects vantage6Source GCVE Database
Rated by Threat Radar
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIvantage6 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
No patches or workarounds are currently available. Users should monitor vendor advisories for updates and consider restricting developer permissions or implementing additional manual review controls until an official fix is released.
Description
A vulnerability in vantage6 allows an algorithm developer to edit another developer's algorithm that is pending or under review due to missing ownership checks on edit permissions. This flaw enables unauthorized modification of algorithm metadata, such as updating the image or image tag, which could lead to approval of an unintended image version. No patches or workarounds are currently available for this issue. The vulnerability affects vantage6 versions up to and including 5.0.2.
Impact
Unauthorized developers can modify algorithm metadata during the review process, specifically the image or image tag, which could result in nodes trusting and running an unintended or malicious image. This compromises the integrity of the algorithm deployment process. There are no known exploits in the wild currently.
Summary
The vantage6 vulnerability arises from a lack of ownership verification on edit permissions, permitting one developer to alter metadata of another developer's algorithm that is pending or under review. The primary risk is that the image or image tag associated with the algorithm can be changed without proper authorization, potentially causing nodes to trust and execute a different image than the one originally submitted for review. There is no official patch or workaround available at this time. The vulnerability is tracked as CWE-863 (Incorrect Authorization) and affects vantage6 versions <=5.0.2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on integrity.