Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

GHSA-47w6-gwp4-w6vc | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-47w6-gwp4-w6vc

GHSA-47w6-gwp4-w6vc

HIGH7.1

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Published Jul 24, 2026

Modified 3 weeks ago

Details

Impact

Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.

Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

Patches

Workarounds

Affected Packages

vantage6

PyPI

References

ADVISORY

https://github.com/advisories/GHSA-47w6-gwp4-w6vc

PACKAGE

https://github.com/vantage6/vantage6

WEB

https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc

Aliases

CVE-2026-73652

CVSS Analysis

CVSS v4.0

7.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

7.1/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Weakness Type (CWE)

Access Control

CWE-863

Incorrect Authorization

CVE-2026-73652

Ecosystems

PyPI

Timeline

PublishedJul 24, 2026

ModifiedAug 13, 2026