CVE-2026-18750
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In vinny/views.py, the ModifyEmailNotifications function has an IDOR vulnerability: it fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking if the record's contact belongs to the requesting group-admin. This lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
Risk Assessment
Possible unauthorized access to contact data and manipulation of notifications across tenants, compromising confidentiality and integrity.
Recommendation
Implement ownership checks before the operation to ensure the contact belongs to the requesting group-admin.
Other vulnerabilities in VINCE
See all- CVE-2026-18749Critical
The type=track branch authorizes only on _is_my_case(t_attach.case) and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaking not-yet-released coordinator material to vendors on the case.
- CVE-2026-18744Medium
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.
Original NVD description (English source)
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS