CVE-2023-22738 Improper Preservation of Permissions in vantage6

Medium 6.3 Published 1 Mar 2023 Updated 6 Mar 2025

Users assigned to a new organization retain old permissions, allowing unauthorized access to data in the new organization.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-22738?

CVE-2023-22738 is a medium-severity missing authorization vulnerability in vantage6, published on 1 Mar 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.

Weakness: CWE-281

Which versions are affected by CVE-2023-22738?

3 open source packages ship an affected version, including vantage6. It affects 1 product.

Package	Affected	Fixed in
`vantage6` PyPI	All versions	`3.6.1, 3.8.0rc3`
`vantage6` PyPI	All versions	`3.8.0`
`vantage6` PyPI	All versions	`3.8.0`

Products include Vantage6 Vantage6.

How do I fix CVE-2023-22738?

Upgrade vantage6 to a fixed version for your release line: 3.6.1, 3.8.0rc3 or 3.8.0.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-22738 being exploited?

There is no known exploitation of CVE-2023-22738 in the wild and no public exploit code.

Sources

Also known as GHSA-vvjv-97j8-94xh, PYSEC-2023-53.