CVE-2026-18744 - Vulnerability Details - OpenCVE

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Cert	Vince

No data.

No data.

References

Link	Providers
https://github.com/CERTCC/VINCE
https://github.com/CERTCC/VINCE/pull/235

History

Thu, 13 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-639
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 13 Aug 2026 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cert Cert vince
Vendors & Products		Cert Cert vince

Thu, 13 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Wed, 12 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.
Title		CVE-2026-18744
References		https://github.com/CERTCC/VINCE https://github.com/CERTCC/VINCE/pull/235

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-08-12T21:11:19.926Z

Updated: 2026-08-13T15:45:30.377Z

Reserved: 2026-08-03T21:13:39.481Z

Link: CVE-2026-18744

Vulnrichment

Updated: 2026-08-13T15:45:25.880Z

NVD

Status : Received

Published: 2026-08-12T22:17:14.823

Modified: 2026-08-13T16:17:58.807

Link: CVE-2026-18744

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18744", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-08-03T21:13:39.481Z", "datePublished": "2026-08-12T21:11:19.926Z", "dateUpdated": "2026-08-13T15:45:30.377Z"}, "containers": {"cna": {"title": "CVE-2026-18744", "descriptions": [{"lang": "en", "value": "Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id \u2014 test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "CERT/CC", "product": "VINCE", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.44", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "references": [{"url": "https://github.com/CERTCC/VINCE"}, {"url": "https://github.com/CERTCC/VINCE/pull/235"}], "x_generator": {"engine": "VINCE 3.0.44", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18744"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-08-12T21:11:19.926Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T15:44:59.345311Z", "id": "CVE-2026-18744", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:45:30.377Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-18744", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T15:44:59.345311Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:45:25.880Z"}}], "cna": {"title": "CVE-2026-18744", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "CERT/CC", "product": "VINCE", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.44", "versionType": "custom"}]}], "references": [{"url": "https://github.com/CERTCC/VINCE"}, {"url": "https://github.com/CERTCC/VINCE/pull/235"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.44", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-18744"}, "descriptions": [{"lang": "en", "value": "Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id \u2014 test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-08-12T21:11:19.926Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18744", "state": "PUBLISHED", "dateUpdated": "2026-08-13T15:45:30.377Z", "dateReserved": "2026-08-03T21:13:39.481Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-08-12T21:11:19.926Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}