GHSA-rf54-7qrr-96j6 · Severity: low · Ecosystem: pip — vantage6 does not properly delete linked resources when deleting a collaboration
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
Conclusion & alert: CVE-2023-41881 is rated Low Risk (23/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.08%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-21 | 0.15% | 0.08% | -0.08% |
| 2 | 2025-11-18 | 0.08% | 0.15% | +0.08% |
| 3 | 2025-04-15 | — | 0.08% | — |
Full EPSS history (8 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 3.7 | 3.1 | LOW |
|
0.6 | 2.7 | [email protected] |
| 4.3 | 3.1 | MEDIUM |
|
2.8 | 1.4 | [email protected] |
GHSA-rf54-7qrr-96j6 · Severity: low · Ecosystem: pip — vantage6 does not properly delete linked resources when deleting a collaboration