CVE-2026-18749: Information Disclosure Vulnerability

CVE-2026-18749 Overview

CVE-2026-18749 is a broken access control flaw in the CERT Coordination Center (CERT/CC) Vulnerability Information and Coordination Environment (VINCE) platform. The type=track retrieval branch authorizes attachment access using only the _is_my_case(t_attach.case) check. It never validates the VinceTrackAttachment.shared flag before returning the file. As a result, any case member who possesses or receives an attachment uuid can retrieve coordinator-uploaded artefacts that have not yet been marked shared. The flaw leaks pre-release coordinator material to vendors participating in the same case.

Critical Impact
Vendors on a coordinated vulnerability disclosure case can retrieve internal coordinator attachments that were never intended for release, undermining the confidentiality boundary between coordinators and affected parties.

Affected Products

CERT/CC VINCE (Vulnerability Information and Coordination Environment)
VINCE case tracking module handling VinceTrackAttachment objects
Deployments running the vulnerable type=track attachment retrieval branch

Discovery Timeline

2026-08-12 - CVE-2026-18749 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18749

Vulnerability Analysis

VINCE coordinates multi-party vulnerability disclosure between researchers, coordinators, and affected vendors. Case attachments belong to one of two visibility tiers: internal coordinator-only material and material explicitly shared with case participants. The shared boolean on VinceTrackAttachment enforces that separation.

The vulnerable code path handles requests where type=track. It resolves the attachment, verifies the requester is a member of the associated case via _is_my_case(t_attach.case), and then returns the file. The shared attribute is never consulted. Any authenticated case participant who learns an attachment uuid can retrieve unreleased coordinator artefacts, bypassing the intended editorial gate.

This is a missing authorization check [CWE-862] combined with an insecure direct object reference pattern. The uuid is a capability token in the eyes of the code, but it was never designed to carry authorization semantics on its own.

Root Cause

The root cause is an incomplete access control predicate. Correct authorization requires both case membership and the shared flag being true for non-coordinator viewers. The type=track branch enforces only the first condition, treating case membership as sufficient authority to read any tracked attachment.

Attack Vector

An authenticated vendor account on an active VINCE case obtains or guesses an attachment uuid for coordinator-uploaded material. The vendor issues a retrieval request against the type=track endpoint using that uuid. VINCE confirms case membership, skips the shared check, and returns the file contents. The attacker gains access to draft advisories, coordinator notes, or embargoed technical details that were staged but not yet released. See the GitHub CERTCC Pull Request #235 for the corrective patch and the GitHub CERTCC VINCE Repository for source context.

Detection Methods for CVE-2026-18749

Indicators of Compromise

Access log entries showing type=track attachment retrievals by non-coordinator accounts referencing attachments whose shared value in the database is False.
Requests to attachment endpoints containing uuid values that were never announced in case correspondence or shared case timelines.
Anomalous download volume from vendor accounts against a single case during coordinator drafting phases.

Detection Strategies

Correlate application audit logs with the VinceTrackAttachment.shared state at the time of each retrieval. Flag any successful download where shared was False and the requester was not a coordinator.
Alert on repeated retrieval attempts against enumerated or brute-forced uuid values by the same authenticated principal.
Baseline expected vendor download patterns per case and surface deviations for review.

Monitoring Recommendations

Enable verbose logging on the VINCE attachment view handlers, capturing user identity, case identifier, attachment uuid, and the shared field value at retrieval time.
Forward web and application logs into a centralized analytics platform and retain them for the duration of open cases plus a post-closure review window.
Review coordinator upload activity against subsequent vendor download activity during case triage.

How to Mitigate CVE-2026-18749

Immediate Actions Required

Apply the fix delivered in GitHub CERTCC Pull Request #235, which adds the missing shared check to the type=track branch.
Audit historical attachment retrieval logs for any non-coordinator access to attachments where shared was False, and notify affected case coordinators.
Rotate or invalidate attachment uuid values that were exposed prior to remediation where the workflow permits.

Patch Information

The CERT/CC VINCE maintainers addressed the issue in pull request #235 in the GitHub CERTCC VINCE Repository. Operators of self-hosted VINCE instances should pull the updated branch, review the diff for the attachment retrieval logic, and redeploy. Verify that the corrected code path enforces both _is_my_case(t_attach.case) and VinceTrackAttachment.shared before returning file contents to non-coordinator principals.

Workarounds

Restrict coordinator uploads to out-of-band storage until the patch is deployed, sharing artefacts only through channels enforcing explicit release control.
Withhold attachment uuid values from case correspondence during drafting phases so that vendors cannot guess or replay them.
Temporarily disable the type=track attachment retrieval branch at the reverse proxy layer if operational impact is acceptable.

bash

# Example reverse proxy rule to block the vulnerable branch pending patch
# nginx snippet
location ~* /vince/.*attachment {
    if ($arg_type = "track") { return 403; }
}