CVE-2023-41882

    Dashboard / Vulnerabilities / CVE-2023-41882

    CVE-2023-41882

    Published: 11 Oct 2023Last Modified: 12 Aug 2026

    Summary: vantage6 Improper Access Control vulnerability

    Details: vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.

    References: https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41882.json, https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r, https://nvd.nist.gov/vuln/detail/CVE-2023-41882, https://github.com/vantage6/vantage6/pull/711

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7948b4b29f203df3b87f2f2a65bb44ee3e58433b

    Affected versions

    version/4.0.0a6
    version/4.0.0a10
    version/4.0.0a9
    version/4.0.0a8
    version/4.0.0a7
    version/4.0.0a5
    version/4.0.0a4
    version/4.0.0a3
    version/4.0.0a2
    version/4.0.0a1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-41882 | CVE-DB