Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
1.0
CVE-2023-41881: vantage6 may expose old collaboration data after deletion
CVE-2023-41881 · published 3 years ago
Summary
When a collaboration is removed in the Vantage6 platform, any tasks or other resources tied to it are not always cleared out. In versions before 4.0.0, if a new collaboration later reuses the same identifier, some users could inadvertently see results from the previous, deleted collaboration. Upgrade to version 4.0.0 or later to ensure all linked resources are properly removed.
What to do
- Update vantage6 team vantage6 to version 4.0.0.
- Update vantage6 vantage6 to version 4.0.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | vantage6 team | vantage6 |
< 4.0.0 Fix: upgrade to 4.0.0
|
| – | vantage6 | vantage6 |
< 4.0.0 cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:* |
Original advisory text
Deleting a collaboration should also delete linked resources
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
References
- https://github.com/vantage6/vantage6/commit/cce9538f8b70e814c080dd0ae43b297f3af8...
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-20...
- https://github.com/advisories/GHSA-rf54-7qrr-96j6
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f... URL
- https://nvd.nist.gov/vuln/detail/CVE-2023-41881 Vendor Advisory
- https://github.com/vantage6/vantage6/pull/748 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41881... Vendor Advisory
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rf54-7qrr-96j6 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-200Information Exposure
CWE-708Incorrect Ownership Assignment
Timeline
Published11 Oct 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta