CVE-2026-18744

Received Received - Intake

Authenticated Case Data Exposure in Vendor Support Portal

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: CERT/CC

Description

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18744

EUVD

EUVD-2026-57634

Affected Vendors & Products

Vendor	Product	Version / Range
cert_coordination_center	vince	3.0.44

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability allows any authenticated user to access another vendor's CaseStatement and per-vulnerability CaseMemberStatus by providing the target member's ID. The function fails to verify ownership of the member ID, bypassing share_status checks and leaking embargoed information across tenants.

Detection Guidance

This vulnerability involves improper access control in the VINCE platform where authenticated users can access unauthorized data. To detect it, review application logs for unauthorized access attempts to CaseStatement or CaseMemberStatus endpoints. Check for requests with modified member IDs that bypass share_status restrictions. Verify if users can fetch data belonging to other vendors.

Impact Analysis

An attacker could exploit this to view sensitive case details, including whether other vendors are affected by vulnerabilities and their confidential statements. This could lead to information leaks, competitive disadvantages, or unauthorized access to embargoed data.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive vendor and case information. It could result in non-compliance due to improper data sharing and insufficient access controls.

Mitigation Strategies

Implement strict access controls to ensure authenticated users can only access their own cases and associated data. Review and update the _is_my_case function to verify ownership of the member ID before allowing access to CaseStatement or CaseMemberStatus. Disable cross-tenant data sharing if not required.

Hi! I’m here to help you understand CVE-2026-18744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70