CVE-2026-18744

medium

Description

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.

References

https://github.com/CERTCC/VINCE/pull/235

https://github.com/CERTCC/VINCE

Details

Source: Mitre, NVD

Published: 2026-08-12

Updated: 2026-08-12

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3