CVE-2023-22738

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Mar 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-227396.5Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-CVE-2023-227406.5Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Alloca CVE-2023-227419.8Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks bo CVE-2023-227425.9libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 doe CVE-2023-227437.3Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL a CVE-2023-227456.4tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2 CVE-2023-227467.5CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of t CVE-2023-227479.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227489.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-227499.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p CVE-2023-22755.4The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to unauthorized access of data and addition of data du CVE-2023-227509.8There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted p