CVE-2026-18749

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18749", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-08-03T21:27:40.008Z", "datePublished": "2026-08-12T21:10:19.828Z", "dateUpdated": "2026-08-13T15:46:38.941Z"}, "containers": {"cna": {"title": "CVE-2026-18749", "descriptions": [{"lang": "en", "value": "The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid \u2014 leaks not-yet-released coordinator material to vendors on the case."}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "CERT/CC", "product": "VINCE", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.44", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "references": [{"url": "https://github.com/CERTCC/VINCE"}, {"url": "https://github.com/CERTCC/VINCE/pull/235"}], "x_generator": {"engine": "VINCE 3.0.44", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18749"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-08-12T21:10:19.828Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T15:46:20.323615Z", "id": "CVE-2026-18749", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:46:38.941Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-18749", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T15:46:20.323615Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:46:35.566Z"}}], "cna": {"title": "CVE-2026-18749", "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "CERT/CC", "product": "VINCE", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.44", "versionType": "semver"}]}], "references": [{"url": "https://github.com/CERTCC/VINCE"}, {"url": "https://github.com/CERTCC/VINCE/pull/235"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.44", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18749"}, "descriptions": [{"lang": "en", "value": "The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid \u2014 leaks not-yet-released coordinator material to vendors on the case."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-08-12T21:10:19.828Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18749", "state": "PUBLISHED", "dateUpdated": "2026-08-13T15:46:38.941Z", "dateReserved": "2026-08-03T21:27:40.008Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-08-12T21:10:19.828Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "VINCE", "vendor": "CERT/CC", "versions": [{"lessThan": "3.0.44", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid \u2014 leaks not-yet-released coordinator material to vendors on the case."}, {"lang": "es", "value": "La rama type=track autoriza solo en _is_my_case(t_attach.case) y nunca verifica VinceTrackAttachment.shared. Un artefacto de caso subido por el coordinador que NO ha sido marcado como compartido a\u00fan puede ser recuperado por cualquier miembro del caso que tenga (o al que se le env\u00ede) su uuid - filtra material del coordinador a\u00fan no publicado a los proveedores del caso."}], "id": "CVE-2026-18749", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18749", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T15:46:20.323615Z", "version": "2.0.3"}}]}, "published": "2026-08-12T22:17:14.933", "references": [{"source": "cret@cert.org", "url": "https://github.com/CERTCC/VINCE"}, {"source": "cret@cert.org", "url": "https://github.com/CERTCC/VINCE/pull/235"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.44)"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "VINCE", "source": "cna", "vendor": "CERT/CC"}, "product": "vince", "vendor": "cert"}], "created": "2026-08-13T02:15:02.666301+00:00", "title": "Authorization Bypass in VINCE Allows Unauthorized Retrieval of Non-Shared Case Artefacts", "updated": "2026-08-13T19:30:03.341977+00:00", "vendors": ["cert", "cert$PRODUCT$vince"]}