EUVD-2026-57633
GHSA-fmgm-gh7c-hwv2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker must be an authenticated case member (PR:L), exploitation is trivial once the UUID is known (AC:L), and impact is confidentiality-only disclosure of embargoed attachments (C:H, I:N, A:N).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
6DescriptionCVE.org
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid - leaks not-yet-released coordinator material to vendors on the case.
AnalysisAI
Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.44 lets any authenticated member of a coordination case retrieve coordinator-uploaded attachments that were never marked as shared. The type=track download branch checks only case membership (_is_my_case) and omits the VinceTrackAttachment.shared gate, so a vendor on a case who knows or is sent an artefact's UUID can pull not-yet-released coordinator material. EPSS is low (0.15%, 4th percentile) and no public exploit is identified; this is a logic/authorization defect fixed upstream in PR #235.
Technical ContextAI
VINCE is the Django-based multi-tenant vulnerability coordination platform operated by CERT/CC (and adopted by some CSIRTs/PSIRTs) to manage embargoed vulnerability cases among coordinators, reporters, and affected vendors. The flaw is a CWE-639 authorization-bypass-through-user-controlled-key (IDOR-class) issue: the attachment-download handler for type=track resolves the object by its user-supplied UUID and authorizes solely on _is_my_case(t_attach.case), while entirely skipping the VinceTrackAttachment.shared boolean that is meant to distinguish coordinator-internal artefacts from those deliberately released to case participants. Because the shared flag is the intended visibility control and it is never evaluated on this code path, membership in the case becomes sufficient to read any tracked attachment regardless of its release state. The CPE cpe:2.3:a:cert/cc:vince confirms the affected product, and the fix (PR #235) resides in the vince/vinny Django apps exercised by the newly added PR test suite.
RemediationAI
Upgrade VINCE to version 3.0.44 or later, which adds the missing VinceTrackAttachment.shared authorization check on the type=track download path (Vendor-released patch: 3.0.44; fix in https://github.com/CERTCC/VINCE/pull/235). If you cannot upgrade immediately, apply the upstream commit from PR #235 to your instance, or as a compensating control restrict the tracked-attachment download endpoint and enforce that coordinator-uploaded artefacts are not attached to a case until they are genuinely ready to be shared (trade-off: disrupts normal coordinator workflow and staging of embargoed material). Additionally audit access logs for retrievals of unshared attachment UUIDs by vendor/reporter accounts to detect any prior exposure, and rotate/re-issue any sensitive artefacts that may have leaked. See the repository at https://github.com/CERTCC/VINCE for release details.
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. Rated medium severity (CVSS 6.1), this
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. Rated high severity (CVSS 8.8), t
Cross-tenant IDOR in CERT/CC's VINCE platform allows any authenticated case participant to read another vendor's embargo
VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowin
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Rated medium severity
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this
Insecure Direct Object Reference (IDOR) in CERT/CC's VINCE coordination platform allows an authenticated vendor admin to
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. Rated medium se
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today