vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

PYSEC-2026-3703 · CVE-2026-73652 · GHSA-47w6-gwp4-w6vc

Published Aug 19, 2026 · Modified Aug 19, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Impact

Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.

Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

Patches

Workarounds

References

WEB https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc
PACKAGE https://github.com/vantage6/vantage6
PACKAGE https://pypi.org/project/vantage6
ADVISORY https://github.com/advisories/GHSA-47w6-gwp4-w6vc
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-73652

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes