Executive brief
Defining resource name as integer may give unintended access in vantage6
Affected products
- PyPI vantage6-node
- PyPI vantage6
Junglewise Threat Intelligence
CVE-2023-28635: PYSEC-2026-2006 - Defining resource name as integer may give unintended access in vantage6
CVE-2023-28635 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: vantage6-node (PyPI), vantage6 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3703 - vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
- vantage6 incorrect authorization in algorithm review process
- PYSEC-2026-2007 - vantage6 collaboration admins can extend their influence by expanding the collaboration
- PYSEC-2026-2005 - vantage6 vulnerable to a username timing attack on recover password/MFA token
- PYSEC-2026-2004 - vantage6's CORS settings overly permissive