Is CVE-2026-18744 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18744 being exploited in the wild.

How severe is CVE-2026-18744?

Medium severity, with a CVSS score of 6.5, published 12 August 2026.

Is there a fix for CVE-2026-18744?

A patch was published on 2026-08-13: Version 3.0.44 released with permission checks fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18744 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18744?

Check whether you run CERTCC VINCE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18744: CERT VINCE case statement cross-tenant information disclosure

CVE-2026-18744 · Severity: medium · CVSS 6.5 · Published 2026-08-12

VINCE is a vulnerability coordination platform used by CERT/CC and security teams to manage coordinated disclosure across vendors. An authentication bypass allows any authenticated participant to retrieve confidential case statements and vendor status details from other organizations by manipulating API parameters. This could expose embargoed vulnerability information before coordinated public release, undermining the entire vulnerability coordination process and potentially enabling faster exploitation.

Technologies: CERTCC VINCE. Vendors: CERTCC.

Quick answers

Is CVE-2026-18744 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18744 being exploited in the wild.
How severe is CVE-2026-18744?: Medium severity, with a CVSS score of 6.5, published 12 August 2026.
Which products and versions are affected?: CERTCC VINCE before 3.0.44.
Is there a fix for CVE-2026-18744?: A patch was published on 2026-08-13: Version 3.0.44 released with permission checks fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18744 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18744?: Check whether you run CERTCC VINCE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken object-level access control vulnerability exists in the VINCE case statement API endpoint. The vulnerable function validates only that the request originates from an authenticated case participant (checks `_is_my_case`), but fails to verify that the requesting user has authorization to access the specific member record referenced in the request parameters (`kwargs['member']`). An attacker can bypass the `share_status` check by directly supplying another organization's member identifier, exposing embargoed vendor statements, affected/not-affected status, and case coordination details. The vulnerability requires valid authentication but does not require user interaction or additional preconditions. A fix was released in version 3.0.44 with enhanced permission checks across the `vinny/views.py` module.

Affected products

CERTCC VINCE before 3.0.44

Timeline

2026-08-12: disclosed: CVE-2026-18744 published
2026-08-13: patched: Version 3.0.44 released with permission checks fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.