---
id: CVE-2024-23823
aliases:
  - GHSA-4946-85pr-fvxh
  - PYSEC-2024-326
  - PYSEC-2026-2004
title: vantage6's CORS settings overly permissive
summary: vantage6's CORS settings overly permissive
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'
vendor: vantage6
product: vantage6
ecosystem: pip
affected:
  - vantage6 < 4.3.0
patched:
  - vantage6 4.3.0
published: '2024-03-15'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:10.154675800Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4946-85pr-fvxh'
references:
  - url: >-
      https://github.com/vantage6/vantage6/security/advisories/GHSA-4946-85pr-fvxh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-23823'
  - url: >-
      https://github.com/vantage6/vantage6/commit/70bb4e1d889230a841eb364d6c03accd7dd01a41
  - url: 'https://github.com/vantage6/vantage6'
tags:
  - osv
  - pip
epss: 0.00314
epssPercentile: 0.21684
ingestedAt: '2026-07-08T18:25:45.296Z'
---

## Overview

### Impact
The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server. 

The impact is limited because v6 does not use session cookies

### Patches
No

### Workarounds
No

## Affected packages

- `vantage6 < 4.3.0`

## Remediation

Upgrade to a patched release:

- `vantage6 4.3.0`