CVE-2026-18749
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The type=track branch authorizes only on _is_my_case(t_attach.case) and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaking not-yet-released coordinator material to vendors on the case.
Risk Assessment
Unintended disclosure of confidential coordinator materials before official release, potentially compromising the coordination process.
Recommendation
Add a check for the shared flag before allowing access to case artefacts.
Other vulnerabilities in VINCE
See all- CVE-2026-18750Medium
In vinny/views.py, the ModifyEmailNotifications function has an IDOR vulnerability: it fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking if the record's contact belongs to the requesting group-admin. This lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
- CVE-2026-18744Medium
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.
- CVE-2026-8142Medium
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as ticket creation or updates.
Original NVD description (English source)
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS