CVE-2026-18750 Overview
CVE-2026-18750 is an Insecure Direct Object Reference (IDOR) vulnerability in the CERT Coordination Center's Vulnerability Information and Coordination Environment (VINCE) platform. The flaw resides in the ModifyEmailNotifications view within vinny/views.py. The view fetches a VinceCommEmail record using the raw primary key supplied in the URL and toggles the email_function and name fields without verifying that the record's contact belongs to the requesting group-admin's vendor. A vendor administrator can flip notification routing or read email addresses and names belonging to another vendor's contacts.
Critical Impact
A vendor administrator authenticated to VINCE can modify or disclose email notification records belonging to unrelated vendors, breaking multi-tenant isolation.
Affected Products
- CERT/CC VINCE (Vulnerability Information and Coordination Environment)
- vinny/views.py module — ModifyEmailNotifications view
- VinceCommEmail model records tied to vendor contacts
Discovery Timeline
- 2026-08-12 - CVE-2026-18750 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18750
Vulnerability Analysis
The vulnerability is a classic Insecure Direct Object Reference [CWE-639] in a Django-based multi-tenant coordination platform. VINCE hosts coordination communications across multiple vendors participating in vulnerability disclosure. The ModifyEmailNotifications view in vinny/views.py accepts a primary key parameter from the request URL and loads the corresponding VinceCommEmail object directly. The view then permits updates to the email_function and name attributes of that record.
The view does not enforce a tenant boundary check. It does not confirm that the loaded VinceCommEmail record is associated with a contact belonging to the vendor group the requesting user administers. Any authenticated vendor group-admin can therefore address records outside their scope by iterating or guessing primary keys.
The practical outcome is two-fold. First, an attacker can read email addresses and display names of contacts belonging to competing vendors. Second, an attacker can flip notification routing flags, redirecting or suppressing coordination emails intended for another vendor's contacts.
Root Cause
The root cause is missing object-level authorization. The view performs authentication and general group-admin role checks but omits the record-scope check that ties the target VinceCommEmail back to the caller's vendor group.
Attack Vector
Exploitation requires an authenticated VINCE account with vendor group-admin privileges. The attacker sends a crafted request to the ModifyEmailNotifications endpoint substituting a VinceCommEmail primary key that belongs to another vendor. No specialized tooling is required. Refer to the GitHub Pull Request #235 Documentation for the patch details and the CERTCC VINCE Project Overview for platform context.
Detection Methods for CVE-2026-18750
Indicators of Compromise
- Unexpected changes to VinceCommEmail records where the email_function or name field was modified by a user not associated with the record's owning vendor group.
- Access log entries showing POST requests to the ModifyEmailNotifications endpoint with primary keys that fall outside the requesting user's vendor scope.
- Sequential or non-sequential primary key enumeration patterns from a single authenticated session.
Detection Strategies
- Audit Django application logs and database change history for VinceCommEmail updates, correlating the acting user's vendor group with the record's contact vendor.
- Add server-side telemetry that records the caller identity, target primary key, and vendor ownership on every hit to ModifyEmailNotifications.
- Review recent notification routing changes for anomalies such as flags flipped without a corresponding administrative ticket.
Monitoring Recommendations
- Alert when a single authenticated session issues multiple ModifyEmailNotifications requests referencing primary keys tied to different vendor groups.
- Monitor for outbound notification traffic that stops flowing to expected vendor contacts, which may indicate suppressed routing.
- Track failed and successful modifications against a baseline of legitimate administrative activity for each vendor.
How to Mitigate CVE-2026-18750
Immediate Actions Required
- Apply the fix from GitHub Pull Request #235 to the deployed VINCE instance.
- Audit all recent modifications to VinceCommEmail records and revert unauthorized changes to email_function and name fields.
- Review vendor group-admin accounts and rotate credentials for any account showing suspicious activity against the ModifyEmailNotifications endpoint.
Patch Information
CERT/CC published the corrective change through GitHub Pull Request #235 in the CERTCC/VINCE repository. Operators of self-hosted VINCE deployments should pull the patched revision and redeploy. The fix adds an ownership check that confirms the target VinceCommEmail contact belongs to the requesting group-admin's vendor group before permitting reads or writes.
Workarounds
- Temporarily restrict access to the ModifyEmailNotifications view at the reverse proxy layer until the patch is deployed.
- Reduce the number of accounts holding vendor group-admin privileges to shrink the exploitable population.
- Enable enhanced application logging for the affected view and manually review changes until the code fix is in place.
# Example reverse-proxy restriction (nginx) to block the vulnerable endpoint
# until the patch from PR #235 is deployed
location ~ ^/vince/notifications/modify/ {
deny all;
return 403;
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
