Tracked Case Artefact Leak in VinceTrack

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: CERT/CC

Description

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-18749

EUVD

EUVD-2026-57633

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthorized access to case artifacts in a system. It occurs because the system checks only if a user is part of a case but does not verify whether the artifact is marked as shared. This means non-shared, coordinator-uploaded files can be accessed by any case member using the file's UUID, potentially exposing unreleased material.

Impact Analysis

If you are part of a case, this vulnerability could allow others to access sensitive files you uploaded but did not intend to share. This may lead to data leaks, unauthorized disclosure of confidential information, or exposure of unreleased materials to unintended parties.

Hi! I’m here to help you understand CVE-2026-18749. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70