{"cve":"CVE-2023-28635","nvd":{"published":"2023-10-11T20:15:09.893","modified":"2026-06-17T05:48:26.400","status":"Modified","description":"vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm. There may also be other places in the code where such a mixup of resource ID or name leads to issues. Version 4.0.0 contains a patch for this issue. The best solution is to check when resources are created or modified, that the resource name always starts with a character.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-863"],"references":["https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400","https://github.com/vantage6/vantage6/pull/744","https://github.com/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2","https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400","https://github.com/vantage6/vantage6/pull/744"],"products":["vantage6:vantage6"],"source":"nvd","synced_at":"2026-10-19T21:39:34.467980132+00:00"},"epss":{"cve":"CVE-2023-28635","score":0.00504,"percentile":0.43129,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7x94-6g2m-3hp2","url":"https://osv.dev/vulnerability/GHSA-7x94-6g2m-3hp2","summary":"Defining resource name as integer may give unintended access in vantage6","modified":"2026-09-10T03:49:58.585830520Z","packages":[{"ecosystem":"PyPI","name":"vantage6","purl":"pkg:pypi/vantage6","ranges":["<4.0.0"],"fixed":["4.0.0"]}]},{"id":"PYSEC-2023-198","url":"https://osv.dev/vulnerability/PYSEC-2023-198","summary":"","modified":"2026-07-07T17:57:23.136099527Z","packages":[{"ecosystem":"PyPI","name":"vantage6-node","purl":"pkg:pypi/vantage6-node","ranges":["<4.0.0"],"fixed":["4.0.0"]}]},{"id":"PYSEC-2026-2006","url":"https://osv.dev/vulnerability/PYSEC-2026-2006","summary":"Defining resource name as integer may give unintended access in vantage6","modified":"2026-07-07T17:57:23.136099527Z","packages":[{"ecosystem":"PyPI","name":"vantage6","purl":"pkg:pypi/vantage6","ranges":["<4.0.0"],"fixed":["4.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}