GHSA-47w6-gwp4-w6vc: vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.
Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review
References
Code Behaviors & Features
Detect and mitigate GHSA-47w6-gwp4-w6vc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →