CVE-2023-41882
vantage6 Improper Access Control vulnerability
CVE-2023-41882 is a medium vulnerability (CVSS 5.4) in Vantage6, published October 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in vantage6 4.0.0.
- Severity
- 5.4 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.50%EPSS, 43rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.0vantage6 +1 more
Description
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vantage6PyPI | before 4.0.0 | 4.0.0 |
vantage6PyPI | before 4.0.0, plus listed versions 0.0.00.0.0b00.0.0b10.0.0b31.0.0 Show 45 moreShow less1.0.0a11.0.0a21.0.0b101.0.0b111.0.0b121.0.0b131.0.0b141.0.0b21.0.0b31.0.0b41.0.0b51.0.0b61.0.0b71.0.0b81.0.0b91.1.01.1.0rc11.1.0rc21.2.01.2.11.2.21.2.31.2.3.post22.0.02.0.0.post12.0.0a12.0.0a22.0.0a32.0.1rc12.0.1rc22.1.02.1.0rc12.1.12.2.02.2.0b12.2.0b22.2.0b32.2.0b42.2.12.2.102.2.112.2.122.2.22.2.32.2.4 | 4.0.0 |
What each source reports
CVE List Score used
vantage6 Improper Access Control vulnerability
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.
- Record
CVE-2023-41882- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-863, CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2023-0259
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.
- Record
EUVD-2023-0259- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc57-xhh5-m94r
Improper Access Control in vantage6
Impact
The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, currently it is only checked if the user has permission to view the collaboration.
Patches
No
Workarounds
None
References
None
For more information
If you have any questions or comments about this advisory:
- Email us at vantage6@iknl.nl
- Record
GHSA-gc57-xhh5-m94r- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.
- Record
CVE-2023-41882- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284, CWE-863
- Updated
- 2026-11-02
OSV
vantage6 Improper Access Control vulnerability
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.
- Record
CVE-2023-41882- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284, CWE-863
- Updated
- 2026-11-02
OSVGHSA-gc57-xhh5-m94r
Improper Access Control in vantage6
Impact
The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, currently it is only checked if the user has permission to view the collaboration.
Patches
No
Workarounds
None
References
None
For more information
If you have any questions or comments about this advisory:
- Email us at vantage6@iknl.nl
- Record
GHSA-gc57-xhh5-m94r- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVPYSEC-2023-201
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.
- Record
PYSEC-2023-201- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r
nvd.nist.gov/vuln/detail/CVE-2023-41882
Left out here: 136 versions. The JSON record has them.