What is the CVSS score of CVE-2026-18744?

CVE-2026-18744 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-18744?

Yes, a patch is available for CVE-2026-18744. Update the affected software to the latest version immediately.

VINCE CVE-2026-18744

EUVD-2026-57634 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-12 certcc

GHSA-8pgg-45wg-rcx3

Authentication Bypass Vince Cert Cc

6.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible IDOR with low-privilege account required; sole impact is confidentiality of embargoed vendor data, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 13, 2026 - 16:29 vuln.today

Analysis Generated

Aug 13, 2026 - 16:29 vuln.today

CVSS changed

Aug 13, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Aug 12, 2026 - 22:03 EUVD

CVE Published

Aug 12, 2026 - 21:11 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id - test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.

AnalysisAI

Cross-tenant IDOR in CERT/CC's VINCE platform allows any authenticated case participant to read another vendor's embargoed CaseStatement and per-vulnerability CaseMemberStatus records by supplying an arbitrary member ID in the API request. The authorization check in test_func validates only that the requester is a participant in the case (_is_my_case) but does not verify that the requested member ID belongs to their own organization, making the share_status embargo control bypassable. Affected versions are all VINCE releases before 3.0.44; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

VINCE (Vulnerability Information and Coordination Environment) is CERT/CC's Django-based multi-tenant platform for coordinating vulnerability disclosure between researchers, vendors, and coordinators. The affected component manages CaseStatement objects (vendor affected/not-affected declarations) and CaseMemberStatus records per vulnerability per vendor. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the authorization function test_func accepts a caller-supplied kwargs['member'] identifier and enforces only case-level membership (_is_my_case), skipping the necessary ownership assertion that the member ID must belong to the requesting organization. This IDOR pattern allows horizontal privilege escalation between tenants sharing the same case without any elevation of role. Affected CPE: cpe:2.3:a:cert/cc:vince:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade VINCE to version 3.0.44 or later, which contains the vendor-released fix per the EUVD affected-versions range. The upstream fix pull request is available at https://github.com/CERTCC/VINCE/pull/235, though the provided diff does not show the authorization logic change directly - confirm the patched release at https://github.com/CERTCC/VINCE. If an immediate upgrade is not possible, a compensating control is to restrict VINCE case participation to the minimum necessary set of vendor accounts during active embargo periods, reducing the pool of accounts that could abuse the flaw; note this does not eliminate the vulnerability, only shrinks the attack surface. Audit VINCE access logs for unusual cross-vendor member ID lookups as a detective control while patching is pending.