Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: CERT/CC VINCE 3.0.44 Clear all filters
TI-2026-15360 CVE-2026-18744 · GHSA-8pgg-45wg-rcx3

Authorization bypass in CERT/CC VINCE

Priority LOW 29

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member'].

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00426 Published 2026-08-12 Fixed in 3.0.44 CWE-639
TI-2026-15363 CVE-2026-18749 · GHSA-fmgm-gh7c-hwv2

Authorization bypass in CERT/CC VINCE

Priority MEDIUM 49

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00512 Published 2026-08-12 Fixed in 3.0.44 CWE-639
TI-2026-15364 CVE-2026-18750 · GHSA-j5jq-5w3c-xc48

Authorization bypass in CERT/CC VINCE

Priority LOW 30

vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00325 Published 2026-08-12 Fixed in 3.0.44 CWE-639