The vantage6 vulnerability arises from a lack of ownership verification on edit permissions, permitting one developer to alter metadata of another developer's algorithm that is pending or under review. The primary risk is that the image or image tag associated with the algorithm can be changed without proper authorization, potentially causing nodes to trust and execute a different image than the one originally submitted for review. There is no official patch or workaround available at this time. The vulnerability is tracked as CWE-863 (Incorrect Authorization) and affects vantage6 versions <=5.0.2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on integrity.

Unauthorized developers can modify algorithm metadata during the review process, specifically the image or image tag, which could result in nodes trusting and running an unintended or malicious image. This compromises the integrity of the algorithm deployment process. There are no known exploits in the wild currently.

No patches or workarounds are currently available. Users should monitor vendor advisories for updates and consider restricting developer permissions or implementing additional manual review controls until an official fix is released.