What is the CVSS score of CVE-2026-8142?

CVE-2026-8142 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

VINCE CVE-2026-8142

EUVD-2026-28437 MEDIUM

2026-05-07 certcc

GHSA-v8g3-5j4v-2ghv

Information Disclosure Vince

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 14:22 vuln.today

CVSS changed

May 08, 2026 - 14:22 NVD

6.5 (MEDIUM)

CVE Published

May 07, 2026 - 19:54 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 19:54 nvd

MEDIUM 6.5

DescriptionCVE.org

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

AnalysisAI

VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowing unauthenticated remote attackers to forge email From addresses and trigger automated actions such as ticket creation or updates. The vulnerability combines information disclosure with integrity impact, affecting the reliability of ticket management workflows that depend on sender validation.

Technical ContextAI

VINCE (Vulnerability Information and Coordination Engine) is CERT/CC's coordination platform that processes inbound communications to manage vulnerability disclosures. The vulnerability stems from improper validation of RFC 5321 SMTP From addresses, likely involving character encoding edge cases (e.g., homograph attacks, punycode confusion, or MIME header encoding bypass). The flaw allows attackers to manipulate the From address used in automated processing logic, causing the system to misattribute ticket actions to spoofed senders without requiring authentication. This is a logic flaw in email header parsing and address validation routines, categorized under information disclosure due to exposure of ticket operations to unauthorized actors.

RemediationAI

Upgrade VINCE to a version newer than 3.0.38 as soon as it is released by CERT/CC. Until a patched version is available, implement the following compensating controls: (1) Disable automated ticket creation or updates from email sources, requiring manual review and approval of all inbound email-triggered actions - this eliminates the exploit vector but may reduce operational efficiency; (2) Implement email authentication (SPF, DKIM, DMARC) and configure VINCE to reject emails failing authentication checks before processing - this validates sender legitimacy at the SMTP level but requires coordination with your mail infrastructure; (3) Restrict access to VINCE's email ingestion endpoints to a whitelist of trusted mail relays only - this limits attack surface but complicates mail routing for external reporters. Monitor the CERT/CC VINCE advisory page at https://kb.cert.org/vince and the GitHub repository security advisories for patch availability.