CVE-2026-8142

Full vulnerability record from the local CVENow database.

Description

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

Severity

MEDIUM

CVSS score

6.5 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-05-07 20:16:45.670000

Last modified

2026-10-26 00:10:00.150000

View original CVE JSON

{
  "id": "CVE-2026-8142",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T20:16:45.670",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates."
    },
    {
      "lang": "es",
      "value": "Las versiones 3.0.38 y anteriores de VINCE no verifican correctamente la autenticidad de la dirección de origen debido a una confusión de codificación y utilizan la dirección de origen para acciones automatizadas como la creación de tickets o la actualización de tickets."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "CERT/CC",
          "product": "VINCE",
          "versions": [
            {
              "version": "*",
              "lessThanOrEqual": "3.0.38",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T13:54:55.991111Z",
          "id": "CVE-2026-8142",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://github.com/CERTCC/VINCE",
      "source": "[email protected]"
    },
    {
      "url": "https://kb.cert.org/vince",
      "source": "[email protected]"
    }
  ]
}