CVE-2026-73652: 
Python vulnerability analysis and mitigation

CVE-2026-73652 is an incorrect authorization vulnerability in vantage6, an open-source infrastructure for privacy-preserving federated analysis. The flaw allows any authenticated algorithm developer to edit another developer's algorithm while it is pending or under review, including modifying the algorithm image or image tag. All versions up to and including 5.0.2 are affected, and no patched version was available at the time of disclosure. It carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, EUVD).

The root cause is CWE-863 (Incorrect Authorization): the algorithm-store edit endpoint performs an authorization check to confirm the requester has edit permission, but fails to verify that the requester is the owner of the algorithm being modified. This means any authenticated developer with generic edit privileges can send a crafted API request to alter another developer's algorithm record — including changing the container image reference or image tag — while the algorithm is in a pending or under-review state. No special configuration or elevated privileges beyond a standard developer account are required to exploit this flaw (GitHub Advisory).

Successful exploitation allows a malicious algorithm developer to silently substitute a different container image for one that is undergoing security review, causing reviewers and federated nodes to approve and execute an image that was never actually vetted. This represents a significant integrity risk in privacy-preserving analysis workflows, as nodes may process sensitive (potentially health or research) data using a tampered or malicious algorithm. The attack could facilitate supply-chain-style compromise within a vantage6 federation without requiring any elevated system privileges (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid low-privileged developer account within the vantage6 platform, making it non-automatable and limiting the attacker pool to insiders or compromised accounts (GitHub Advisory, EUVD).

1. Obtain a developer account: Register or compromise a legitimate algorithm developer account on the target vantage6 server instance.
2. Identify a target algorithm under review: Browse or query the algorithm store API to find algorithms submitted by other developers that are currently in a pending or under-review state.
3. Craft a malicious edit request: Prepare an API request (e.g., HTTP PATCH/PUT) to the algorithm-store edit endpoint, targeting the victim algorithm's ID and supplying a modified image or image_tag field pointing to an attacker-controlled container image.
4. Submit the request: Send the crafted request authenticated as the attacker's developer account. Due to the missing ownership check, the server accepts the modification.
5. Wait for review approval: Reviewers evaluate the algorithm believing it references the original image; nodes subsequently pull and execute the attacker-substituted image, potentially running malicious code against sensitive federated data (GitHub Advisory).

• Logs: API audit logs showing edit requests to an algorithm record made by a user who is not the original submitter/owner of that algorithm, particularly targeting algorithms in pending or under_review status.
• Application Data: Algorithm records where the image or image_tag field was modified after initial submission, especially if the modification timestamp differs from the submission timestamp and the modifying user differs from the creator.
• Network: Nodes pulling container images from unexpected or external registries not associated with the original algorithm submitter.
• Process/Runtime: Execution of container images with digests or tags that do not match those recorded at the time of review approval (GitHub Advisory).

As of the disclosure date, no patched version of vantage6 is available and no official workaround has been provided by the maintainers. Organizations using vantage6 ≤ 5.0.2 should implement compensating controls: manually verify that the algorithm image and tag recorded at the time of review approval match those at the time of node execution (e.g., using image digests rather than mutable tags), and restrict algorithm-store edit permissions to algorithm owners only at the application or infrastructure level if possible. Monitor the vantage6 GitHub repository for a patched release (GitHub Advisory).