EUVD-2026-57632
GHSA-j5jq-5w3c-xc48
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
PR:L reflects mandatory authenticated vendor-admin session; I:L added because attacker can write notification routing fields for other tenants.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
5DescriptionCVE.org
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
AnalysisAI
Insecure Direct Object Reference (IDOR) in CERT/CC's VINCE coordination platform allows an authenticated vendor admin to manipulate or read notification configuration for contacts belonging to other vendors. The ModifyEmailNotifications view in vinny/views.py resolves a VinceCommEmail record by raw primary key supplied in the URL without verifying that the targeted record belongs to the requesting admin's own vendor group, enabling unauthorized cross-tenant read and write of email routing settings. No public exploit has been identified and EPSS is negligible (0.15%), but the flaw undermines the trust isolation between vendor tenants in a vulnerability coordination context.
Technical ContextAI
VINCE (Vulnerability Information and Coordination Environment) is a Django-based web application developed by CERT/CC for coordinating vulnerability disclosure between researchers and vendors. The affected code path is the ModifyEmailNotifications class-based view in vinny/views.py, which handles vendor notification preferences stored in VinceCommEmail model instances. The root cause is CWE-639 (Authorization Through User-Controlled Key): the view accepts a raw database primary key (pk) from the URL and retrieves the corresponding object without asserting group membership, violating object-level authorization. Any authenticated vendor admin with knowledge of another tenant's VinceCommEmail pk can invoke the view to toggle email_function/name fields or retrieve the stored email address and name - a classic horizontal privilege escalation within a multi-tenant application. The CPE is cpe:2.3:a:cert/cc:vince:*:*:*:*:*:*:*:* and all versions prior to 3.0.44 are affected.
RemediationAI
Upgrade to VINCE 3.0.44 or later, which includes the fix delivered in GitHub PR #235 (https://github.com/CERTCC/VINCE/pull/235). The fix must add an authorization check in the ModifyEmailNotifications view to confirm that the VinceCommEmail record retrieved by pk belongs to a contact within the requesting user's vendor group before allowing read or write access. If immediate upgrade is not possible, a compensating control is to restrict the ModifyEmailNotifications endpoint at the application or reverse-proxy layer to require that the pk in the request URL resolves to a record owned by the authenticated user's group - this can be enforced by adding a Django queryset filter scoped to the user's group (e.g., VinceCommEmail.objects.filter(pk=pk, contact__group=request.user.group)). There are no known workarounds that fully eliminate the risk without a code change; limiting who can hold vendor admin roles in the deployment reduces exposure. Advisory and source: https://certcc.github.com/CERTCC/VINCE/ and https://nvd.nist.gov/vuln/detail/CVE-2026-18750.
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. Rated medium severity (CVSS 6.1), this
Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.4
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. Rated high severity (CVSS 8.8), t
Cross-tenant IDOR in CERT/CC's VINCE platform allows any authenticated case participant to read another vendor's embargo
VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowin
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Rated medium severity
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. Rated medium se
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today