CVE-2026-18749

{
  "id": "CVE-2026-18749",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T22:17:14.933",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case."
    },
    {
      "lang": "es",
      "value": "La rama type=track autoriza solo en _is_my_case(t_attach.case) y nunca verifica VinceTrackAttachment.shared. Un artefacto de caso subido por el coordinador que NO ha sido marcado como compartido aún puede ser recuperado por cualquier miembro del caso que tenga (o al que se le envíe) su uuid - filtra material del coordinador aún no publicado a los proveedores del caso."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "CERT/CC",
          "product": "VINCE",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.0.44",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T15:46:20.323615Z",
          "id": "CVE-2026-18749",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/CERTCC/VINCE",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/CERTCC/VINCE/pull/235",
      "source": "[email protected]"
    }
  ]
}