CVE-2026-18749

Received Received - Intake

Tracked Case Artefact Leak in VinceTrack

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: CERT/CC

Description

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18749

EUVD

EUVD-2026-57633

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthorized access to case artifacts in a system. It occurs because the system checks only if a user is part of a case but does not verify whether the artifact is marked as shared. This means non-shared, coordinator-uploaded files can be accessed by any case member using the file's UUID, potentially exposing unreleased material.

Detection Guidance

This vulnerability involves unauthorized access to case artifacts in VINCE due to improper sharing checks. To detect it, inspect VINCE logs for unauthorized access to attachments or UUID-based retrieval attempts. Check Django admin logs for unusual activity in the VINCETRACK application. Review S3 bucket access logs for unexpected downloads of coordinator-uploaded files.

Impact Analysis

If you are part of a case, this vulnerability could allow others to access sensitive files you uploaded but did not intend to share. This may lead to data leaks, unauthorized disclosure of confidential information, or exposure of unreleased materials to unintended parties.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive case materials, potentially violating data protection requirements under GDPR and HIPAA by exposing non-shared, confidential information to unauthorized parties.

Mitigation Strategies

Review access controls for VinceTrackAttachment.shared to ensure only intended users can access attachments. Verify that _is_my_case(t_attach.case) checks are correctly enforced and shared status is properly validated before retrieval.

Hi! I’m here to help you understand CVE-2026-18749. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70