CVE-2026-8142

Awaiting Analysis Awaiting Analysis - Queue

Vulnerability in VINCE due to From address spoofing

Publication date: 2026-05-07

Last updated on: 2026-05-08

Assigner: CERT/CC

Description

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-07

Last Modified

2026-05-08

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-8142

EUVD

EUVD-2026-28437

Affected Vendors & Products

Vendor	Product	Version / Range
cert_coordination_center	vince	to 3.0.38 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-8142 affects VINCE versions 3.0.38 and earlier, where the system does not properly verify the authenticity of the From address due to encoding confusion.

This vulnerability allows the system to use a potentially spoofed From address for automated actions such as creating or updating tickets.

Impact Analysis

Because VINCE uses the From address for automated ticket creation and updates without proper verification, an attacker could spoof the From address to trigger unauthorized actions.

This could lead to unauthorized ticket creation or modification, potentially causing confusion, mismanagement of vulnerability reports, or exploitation of the coordination process.

Compliance Impact

The provided information does not specify how CVE-2026-8142 impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-8142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70