CVE-2023-41882: Improper Access Control in vantage6
Summary
CVE-2023-41882: Improper Access Control in vantage6. Affects vantage6 versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vantage6 is a Python package available on PyPI that provides a framework for privacy-preserving federated learning and distributed data analysis. It allows users to collaborate on data analysis tasks while maintaining data privacy and security. The package includes various endpoints for managing collaborations and tasks within them.
Vulnerability Detail
The vulnerability identified as CVE-2023-41882 in vantage6 affects the endpoint /api/collaboration/{id}/task. This endpoint is responsible for retrieving tasks from a specific collaboration. However, the access control mechanism for this endpoint is flawed. While it checks if the user has permission to view the collaboration, it fails to verify if the user also has permission to view the tasks within the collaboration. This oversight allows unauthorized users to access and view tasks they should not have access to.
How To Fix
Latest published version: 5.0.3 as of 22 Oct 2026
pip install --upgrade "vantage6==5.0.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0
This is the first release that contains the fix.
pip install --upgrade "vantage6==4.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is recommended to apply the fix by updating the vantage6 package.
Conclusion
The vulnerability in vantage6 allows unauthorized access to tasks within collaborations. To mitigate this vulnerability, users should update their vantage6 installations to version 3.3.3 or later. No workarounds are available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vantage6 →
FAQ
The vulnerability allows unauthorized users to access and view tasks within collaborations they should not have access to. This can lead to unauthorized access to sensitive data and compromise the privacy and security of the collaboration.
You can use the Vulert Playground at Vulert Scanner to check if your vantage6 installation is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the time of this advisory. However, it is important to apply the fix as soon as possible to prevent any potential unauthorized access to tasks.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
For more information, you can email the vantage6 team at vantage6@iknl.nl.
References
Related vulnerabilities
Recent vulnerabilities recorded for vantage6.
