CERT/CC VINCE up to 3.0.43 Attachment Authorization t_attach.case _is_my_case authorization

Summaryinfo

A vulnerability described as problematic has been identified in CERT/CC VINCE up to 3.0.43. The affected element is the function _is_my_case of the file t_attach.case of the component Attachment Authorization. Executing a manipulation of the argument case can lead to authorization. This vulnerability is handled as CVE-2026-18749. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in CERT/CC VINCE up to 3.0.43. This vulnerability affects the function _is_my_case of the file t_attach.case of the component Attachment Authorization. The manipulation of the argument case with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality. CVE summarizes:

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-18749 since 08/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 3.0.44 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• CC
• CERT

Name

• VINCE

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.0.19
• 3.0.20
• 3.0.21
• 3.0.22
• 3.0.23
• 3.0.24
• 3.0.25
• 3.0.26
• 3.0.27
• 3.0.28
• 3.0.29
• 3.0.30
• 3.0.31
• 3.0.32
• 3.0.33
• 3.0.34
• 3.0.35
• 3.0.36
• 3.0.37
• 3.0.38
• 3.0.39
• 3.0.40
• 3.0.41
• 3.0.42
• 3.0.43

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion