vantage6

Advisories 20

• CVE-2026-73652High 7.1

  vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

  Affected: through 5.0.2.

• CVE-2026-54533Medium 6.9

  vantage6 node has an Improper Access Control issue

  Affected: fixed in 5.0.0.

• CVE-2026-54445Medium 6.9

  Vantage6: Set admin user and password from environment or configuration

  Affected: fixed in 5.0.0.

• CVE-2024-27928Medium 5.9

  Vantage6: 2FA can be circumvented with hacked email access

  Affected: fixed in 5.0.0.

• CVE-2024-24769Low 2.1

  Vantage6: No limit on emails sent for password/MFA reset

  Affected: fixed in 5.0.0.

• CVE-2025-43863Low 1.7

  vantage6 lacks brute-force protection on change password functionality

  Affected: fixed in 4.11.0.

• CVE-2024-32969Low 2.7

  vantage6 collaboration admins can extend their influence by expanding the collaboration

  Affected: fixed in 4.5.0rc3.

• CVE-2024-23823Medium 4.2

  CORS settings overly permissive in vantage6

  Affected: fixed in 4.3.0.

• CVE-2024-24770Medium 5.3

  Username timing attack on recover password/MFA token in vantage6

  Affected: fixed in 4.3.0.

• CVE-2024-22193Low 3.5

  vantage6 unencrypted task can be created in encrypted collaboration

  Affected: fixed in 4.2.0.

• CVE-2024-21671Low 3.7

  vantage6 username timing attack

  Affected: fixed in 4.2.0.

• CVE-2024-21653Medium 6.5

  vantage6 insecure SSH configuration for node and server containers

  Affected: fixed in 4.2.0.

• CVE-2024-21649High 8.8

  Remote code execution

  Affected: fixed in 4.2.0.

• CVE-2023-41882Medium 5.4

  vantage6 Improper Access Control vulnerability

  Affected: fixed in 4.0.0.

• CVE-2023-41881Low 3.7

  Deleting a collaboration should also delete linked resources

  Affected: fixed in 4.0.0.