Skip to content
Heist/ feed
Back to feed
Medium

vantage6 Improper Access Control vulnerability

Type: advisorySources: OSV

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-41882
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 05:47 UTC · Revision 1

Source evidence

vantage6 Improper Access Control vulnerability

core-osv · Original source

Published 11 Oct 2023, 19:48 UTC

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.

osv:CVE-2023-41882
Complete source record
{
  "id": "60c35e863b8a11075df8d839c0e008963cb3df15ea104f68a95e008028265a21",
  "url": "https://osv.dev/vulnerability/CVE-2023-41882",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "vantage6 Improper Access Control vulnerability",
    "summary": "vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.",
    "evidence": "osv:CVE-2023-41882",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2023-41882",
      "aliases": [
        "CVE-2023-41882",
        "GHSA-gc57-xhh5-m94r",
        "PYSEC-2023-201"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/vantage6/vantage6",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "7948b4b29f203df3b87f2f2a65bb44ee3e58433b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.0.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.0.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "version/4.0.0a6",
            "version/4.0.0a10",
            "version/4.0.0a9",
            "version/4.0.0a8",
            "version/4.0.0a7",
            "version/4.0.0a5",
            "version/4.0.0a4",
            "version/4.0.0a3",
            "version/4.0.0a2",
            "version/4.0.0a1",
            "version/3.3.6",
            "version/3.3.5",
            "version/3.3.4",
            "version/3.3.3",
            "version/3.3.2",
            "version/3.3.1",
            "version/3.3.0rc4",
            "version/3.3.0",
            "version/3.3.0rc3",
            "version/3.3.0rc2",
            "version/3.3.0rc1",
            "version/0.0.0b3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41882.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.464323284Z",
      "provider": "osv",
      "references": [
        "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41882.json",
        "https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-41882",
        "https://github.com/vantage6/vantage6/pull/711"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284",
          "CWE-863"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41882.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-41882",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492842,
  "published_at": "2023-10-11T19:48:44.606+00:00"
}