CVE-2026-18744: Information Disclosure Vulnerability

CVE-2026-18744 Overview

CVE-2026-18744 is a broken access control vulnerability in the CERT Coordination Center's Vulnerability Information and Coordination Environment (VINCE). Any authenticated case participant can retrieve another vendor's CaseStatement and per-vulnerability CaseMemberStatus by supplying that member's identifier in a request. The view's test_func only validates whether the requester belongs to the case through _is_my_case, but does not verify ownership of the kwargs['member'] parameter. This authorization gap bypasses the share_status control and leaks embargoed vendor affected/not-affected determinations and statement text across tenants.

Critical Impact
Authenticated participants in a coordinated vulnerability disclosure case can read embargoed statements and affectedness data belonging to unrelated vendor members, breaking tenant isolation during pre-disclosure coordination.

Affected Products

CERT/CC VINCE (Vulnerability Information and Coordination Environment)
VINCE deployments prior to the fix in pull request #235
Any downstream fork of the CERTCC/VINCE repository incorporating the vulnerable view logic

Discovery Timeline

2026-08-12 - CVE-2026-18744 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18744

Vulnerability Analysis

VINCE coordinates multi-party vulnerability disclosure between reporters, coordinators, and multiple vendor members. Each vendor member submits a CaseStatement and per-vulnerability CaseMemberStatus describing whether their product is affected. These records are gated by a share_status flag that controls cross-member visibility during embargo.

The vulnerable view protects access using a test_func that calls _is_my_case. The check confirms the requesting user participates in the case identified in the URL. It does not confirm the user is the member identified by kwargs['member']. An authenticated participant can therefore substitute any other member's identifier and retrieve that member's statement and per-vulnerability status entries.

The consequence is a horizontal privilege escalation within a coordination case. The disclosed data includes embargoed affectedness determinations and free-text statements that vendors expect to remain confidential until coordinated publication. See the CERTCC VINCE repository and pull request #235 for the corrective code.

Root Cause

The root cause is missing object-level authorization [CWE-639-class defect]. The view relies solely on case membership and never reconciles the authenticated principal with the member argument used to fetch the target records. Ownership of the queried CaseMember object must be validated before returning CaseStatement and CaseMemberStatus data.

Attack Vector

An attacker requires only a legitimate account participating in a shared VINCE case. The attacker enumerates or guesses other member identifiers within the same case and issues authenticated HTTP requests that substitute those identifiers in the vulnerable route. The server returns statements and status rows for the substituted member, bypassing share_status restrictions. No specialized tooling is required beyond a browser or an HTTP client capable of authenticated requests.

Detection Methods for CVE-2026-18744

Indicators of Compromise

Authenticated requests where the member path or query parameter does not correspond to any CaseMember associated with the requesting user account.
Repeated sequential or enumerative access patterns against endpoints returning CaseStatement or CaseMemberStatus for varying member identifiers within a single session.
Application log entries showing a single principal retrieving statements attributed to multiple distinct vendor members within a short window.

Detection Strategies

Correlate authenticated session identity against the member identifier used in each request and alert on mismatches.
Add server-side audit logging that records the authenticated user, the case identifier, and the target member identifier for every access to statement views.
Retrospectively review historical access logs for the vulnerable view to identify prior cross-member reads before the fix was applied.

Monitoring Recommendations

Ingest VINCE application and web server logs into a centralized analytics platform and build queries that flag member parameter substitution.
Monitor for unusual volumes of statement retrieval per user account and alert on deviations from baseline coordination activity.
Track authentication events tied to accounts that have accessed multiple member records and prioritize review of those sessions.

How to Mitigate CVE-2026-18744

Immediate Actions Required

Apply the fix from CERTCC VINCE pull request #235 and redeploy the affected VINCE instance.
Audit application logs for prior exploitation and notify affected vendor members whose embargoed statements may have been exposed.
Rotate or invalidate active sessions for accounts that accessed statement endpoints for members they do not represent.

Patch Information

The upstream fix is tracked in CERTCC VINCE pull request #235. The change updates the view's authorization logic so that test_func verifies the authenticated user owns the CaseMember referenced by kwargs['member'], in addition to the existing _is_my_case check. Operators of forked or downstream VINCE deployments must port the same authorization change into their codebase.

Workarounds

Restrict VINCE access to a smaller, trusted set of participants until the patch is deployed to reduce the population able to abuse the flaw.
Place a reverse proxy or web application firewall rule in front of the vulnerable route that rejects requests where the member identifier does not match the authenticated user's known member context.
Temporarily disable the affected statement view route in URL configuration if patching cannot occur immediately and coordination workflows permit.

bash

# Configuration example: log-based detection for mismatched member access
# Grep application logs for authenticated requests to the statement view
grep -E "GET .*/case/.*/member/[0-9]+/statement" /var/log/vince/access.log \
  | awk '{print $1, $7}' \
  | sort -u