CVE-2024-27928
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In versions prior to 5.0.0 of the vantage6 software, an attacker who gains access to a user's email account can reset the password and the 2FA token via email, reducing security to a single authentication factor (email access). Version 5.0.0 fixes this issue.
Risk Assessment
Organizations may be vulnerable to attacks that allow attackers to take over user accounts, potentially leading to unauthorized access to sensitive data. Although most email providers require 2FA, the risk still exists.
Recommendation
It is recommended to upgrade to version 5.0.0 or later to mitigate this vulnerability. Additionally, consider implementing further protective measures for users' email accounts.
Other vulnerabilities in vantage6
See all- CVE-2026-73652High
vantage6 version 5.0.2 and earlier has an algorithm-store edit permission lacking an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted. No fixed version is available as of this review.
- CVE-2026-54533Medium
In versions prior to 5.0.0 of vantage6, malicious algorithms can potentially access other algorithms' input and output files. The issue is fixed in version 5.0.0.
- CVE-2026-54445Medium
In versions prior to 5.0.0 of the vantage6 software, the default user `root` with the password `root` poses a significant security risk. Attackers can easily gain access to the system as many vantage6 servers have this user with admin rights.
- CVE-2024-24769Low
In versions prior to 5.0.0, users can reset their MFA tokens via API routes that send them emails. The number of emails sent is not limited, allowing attackers to flood users' mailboxes.
Original NVD description (English source)
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email and then 2) reset the 2FA token via email. This way they reduce 2FA to 1FA (email access). Note that most email providers require 2FA to access email, so this issue is not very likely to cause issues. Version 5.0.0 fixes the issue. No known workarounds are available.