CVE-2023-41882 - CVE House
Back to Database
Status published Medium CVE-2023-41882

vantage6 Improper Access Control vulnerability

Vulnerability Description

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-41882

Credits & Attribution

No credits recorded in the NVD database.

References

More from vantage6

View All →
CVE-2025-43866
Vantage6 Server JWT secret not cryptographically secure
Low 1.7
CVE-2025-43863
vantage6 lacks brute-force protection on change password functionality
Low 1.7
CVE-2024-32969
vantage6 collaboration admins can extend their influence by expanding the collaboration
Low 2.7
CVE-2024-27928
Vantage6: 2FA can be circumvented with hacked email access
Medium 5.9
CVE-2024-24770
Username timing attack on recover password/MFA token in vantage6
Medium 5.3

Affected Vendor

Affected Software

vantage6
Vulnerable Versions:
< 4.0.0

Timeline

Official Publish: October 11th, 2023
Last Modified: September 17th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-863 CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact