CVE-2026-73652

Received Received - Intake

Algorithm Store Permission Bypass in vantage6

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73652

EUVD

EUVD-2026-58195

Affected Vendors & Products

Vendor	Product	Version / Range
vantage6	vantage6	to 5.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in vantage6 (versions 5.0.2 and earlier) allows an algorithm developer to modify another developer's algorithm while it is pending or under review due to missing ownership checks in the edit permission. The attacker can change metadata like the algorithm image or tag, causing reviewers and nodes to trust a different image than the one originally submitted.

Impact Analysis

If exploited, this vulnerability could lead to the approval of a malicious or unintended algorithm image, potentially causing nodes to execute harmful code. Users relying on the vantage6 platform for privacy-preserving analysis may face data breaches or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized modifications to algorithms handling sensitive data. It undermines data integrity and may lead to unauthorized access or processing, triggering legal and regulatory penalties.

Mitigation Strategies

Immediately restrict algorithm editing permissions to only the original developer. Monitor algorithm submissions for unauthorized changes to metadata like image or image tag. Since no patches are available, avoid using the vantage6 platform until a fix is released.

Hi! I’m here to help you understand CVE-2026-73652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70