Executive brief
VINCE is a vulnerability coordination platform used by CERT/CC and security teams to manage coordinated disclosure across vendors. An authentication bypass allows any authenticated participant to retrieve confidential case statements and vendor status details from other organizations by manipulating API parameters. This could expose embargoed vulnerability information before coordinated public release, undermining the entire vulnerability coordination process and potentially enabling faster exploitation.
Technical details
A broken object-level access control vulnerability exists in the VINCE case statement API endpoint. The vulnerable function validates only that the request originates from an authenticated case participant (checks `_is_my_case`), but fails to verify that the requesting user has authorization to access the specific member record referenced in the request parameters (`kwargs['member']`). An attacker can bypass the `share_status` check by directly supplying another organization's member identifier, exposing embargoed vendor statements, affected/not-affected status, and case coordination details. The vulnerability requires valid authentication but does not require user interaction or additional preconditions. A fix was released in version 3.0.44 with enhanced permission checks across the `vinny/views.py` module.
Affected products
- CERTCC VINCE before 3.0.44
Timeline
- 2026-08-12: disclosed: CVE-2026-18744 published
- 2026-08-13: patched: Version 3.0.44 released with permission checks fix