CVE-2023-28635

CVE-2023-28635 is a medium-severity access control vulnerability affecting vantage6, a privacy-preserving federated learning infrastructure, in versions prior to 4.0.0. Malicious users can bypass access restrictions by creating resources with integer names, potentially gaining unauthorized access to resources or the ability to run algorithms. The CVSS score is 5.4 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating low attack complexity and potential for limited confidentiality and integrity impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.