LOW 3.7 PyPI

vantage6 does not properly delete linked resources when deleting a collaboration

GHSA-rf54-7qrr-96j6 · CVE-2023-41881 · PYSEC-2023-200

Published · Modified

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Description

When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.

This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.

Ready to move

Start Securing

Free, no credit card | First findings in minutes