CVE-2026-18744

Received Received - Intake

Authenticated Case Data Exposure in Vendor Support Portal

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: CERT/CC

Description

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-18744

EUVD

EUVD-2026-57634

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability allows any authenticated user to access another vendor's CaseStatement and per-vulnerability CaseMemberStatus by providing the target member's ID. The function fails to verify ownership of the member ID, bypassing share_status checks and leaking embargoed information across tenants.

Impact Analysis

An attacker could exploit this to view sensitive case details, including whether other vendors are affected by vulnerabilities and their confidential statements. This could lead to information leaks, competitive disadvantages, or unauthorized access to embargoed data.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive vendor and case information. It could result in non-compliance due to improper data sharing and insufficient access controls.

Hi! I’m here to help you understand CVE-2026-18744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70