CVE-2026-18749

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/CERTCC/VINCE
https://github.com/CERTCC/VINCE/pull/235

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) La rama type=track autoriza solo en _is_my_case(t_attach.case) y nunca verifica VinceTrackAttachment.shared. Un artefacto de caso subido por el coordinador que NO ha sido marcado como compartido aún puede ser recuperado por cualquier miembro del caso que tenga (o al que se le envíe) su uuid - filtra material del coordinador aún no publicado a los proveedores del caso.

Information

Published : 2026-08-12 22:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18749

Mitre link : CVE-2026-18749

CVE.ORG link : CVE-2026-18749

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-18749", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18749", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T15:46:20.323615Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "CERT/CC", "product": "VINCE", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.44", "versionType": "semver"}]}]}], "published": "2026-08-12T22:17:14.933", "references": [{"url": "https://github.com/CERTCC/VINCE", "source": "cret@cert.org"}, {"url": "https://github.com/CERTCC/VINCE/pull/235", "source": "cret@cert.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid \u2014 leaks not-yet-released coordinator material to vendors on the case."}, {"lang": "es", "value": "La rama type=track autoriza solo en _is_my_case(t_attach.case) y nunca verifica VinceTrackAttachment.shared. Un artefacto de caso subido por el coordinador que NO ha sido marcado como compartido a\u00fan puede ser recuperado por cualquier miembro del caso que tenga (o al que se le env\u00ede) su uuid - filtra material del coordinador a\u00fan no publicado a los proveedores del caso."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cret@cert.org"}