Executive brief
VINCE is a vulnerability coordination and disclosure platform used by organizations to manage vendor notifications and communications. A flaw in the email notification settings allows a vendor administrator to modify or read email notification preferences for contacts belonging to other vendors, potentially disrupting critical notification routing or exposing sensitive contact information.
Technical details
An insecure direct object reference (IDOR) vulnerability exists in the ModifyEmailNotifications view in vinny/views.py. The view fetches a VinceCommEmail record by a raw primary key from the URL parameter without verifying that the requesting group-admin has authorization to access that record. An attacker with vendor-admin privileges can craft requests with arbitrary VinceCommEmail IDs to toggle the email_function or email_name fields for contacts belonging to other vendors. The vulnerability allows both information disclosure (reading email addresses and notification settings) and unauthorized modification of notification routing. A patch is available in version 3.0.44.
Affected products
- CERTCC VINCE before 3.0.44
Timeline
- 2026-08-12: disclosed
- 2026-08-13: patched