CVE-2026-46699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46699", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T23:26:58.308Z", "datePublished": "2026-06-18T20:47:28.481Z", "dateUpdated": "2026-06-22T12:43:04.430Z"}, "containers": {"cna": {"title": "conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-g95q-3cmj-fvh8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-g95q-3cmj-fvh8"}, {"name": "https://github.com/conda-forge/conda-smithy/commit/3b0bcd92ebd6f41edd341401d84583a20911c587", "tags": ["x_refsource_MISC"], "url": "https://github.com/conda-forge/conda-smithy/commit/3b0bcd92ebd6f41edd341401d84583a20911c587"}], "affected": [{"vendor": "conda-forge", "product": "conda-smithy", "versions": [{"version": "< 3.61.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T20:47:28.481Z"}, "descriptions": [{"lang": "en", "value": "conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue."}], "source": {"advisory": "GHSA-g95q-3cmj-fvh8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T12:42:52.070765Z", "id": "CVE-2026-46699", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T12:43:04.430Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T12:42:52.070765Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T12:42:59.614Z"}}], "cna": {"title": "conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository", "source": {"advisory": "GHSA-g95q-3cmj-fvh8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "conda-forge", "product": "conda-smithy", "versions": [{"status": "affected", "version": "< 3.61.0"}]}], "references": [{"url": "https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-g95q-3cmj-fvh8", "name": "https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-g95q-3cmj-fvh8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/conda-forge/conda-smithy/commit/3b0bcd92ebd6f41edd341401d84583a20911c587", "name": "https://github.com/conda-forge/conda-smithy/commit/3b0bcd92ebd6f41edd341401d84583a20911c587", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-18T20:47:28.481Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46699", "state": "PUBLISHED", "dateUpdated": "2026-06-22T12:43:04.430Z", "dateReserved": "2026-05-15T23:26:58.308Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-18T20:47:28.481Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "conda-smithy", "vendor": "conda-forge", "versions": [{"status": "affected", "version": "< 3.61.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue."}, {"lang": "es", "value": "conda-smithy es una herramienta para combinar una receta conda con configuraciones para construir utilizando servicios de CI alojados gratuitamente en un \u00fanico repositorio. Antes de la versi\u00f3n 3.61.0, una vulnerabilidad en los servicios web automatizados de conda-forge permit\u00eda acceso de escritura no intencionado a los repositorios feedstock a trav\u00e9s de la toma de control de nombres de usuario de GitHub. La causa ra\u00edz es el uso de nombres de usuario de GitHub mutables como identificadores para el enrutamiento de invitaciones a repositorios, en lugar de IDs de usuario de GitHub estables e inmutables. La versi\u00f3n 3.61.0 soluciona el problema."}], "id": "CVE-2026-46699", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46699", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T12:42:52.070765Z", "version": "2.0.3"}}]}, "published": "2026-06-18T21:16:29.053", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/conda-forge/conda-smithy/commit/3b0bcd92ebd6f41edd341401d84583a20911c587"}, {"source": "security-advisories@github.com", "url": "https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-g95q-3cmj-fvh8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.61.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "conda-smithy", "source": "cna", "vendor": "conda-forge"}, "product": "conda-smithy", "vendor": "conda-forge"}], "created": "2026-06-18T22:30:16.765331+00:00", "updated": "2026-06-20T22:55:43.444157+00:00", "vendors": ["conda-forge", "conda-forge$PRODUCT$conda-smithy"]}