Is CVE-2026-18750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18750 being exploited in the wild.

How severe is CVE-2026-18750?

Medium severity, with a CVSS score of 5.3, published 12 August 2026.

Is there a fix for CVE-2026-18750?

A patch was published on 2026-08-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18750 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18750?

Check whether you run CERTCC VINCE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18750: CERTCC VINCE ModifyEmailNotifications insecure direct object reference

CVE-2026-18750 · Severity: medium · CVSS 5.3 · Published 2026-08-12

VINCE is a vulnerability coordination and disclosure platform used by organizations to manage vendor notifications and communications. A flaw in the email notification settings allows a vendor administrator to modify or read email notification preferences for contacts belonging to other vendors, potentially disrupting critical notification routing or exposing sensitive contact information.

Technologies: CERTCC VINCE. Vendors: CERTCC.

Quick answers

Is CVE-2026-18750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18750 being exploited in the wild.
How severe is CVE-2026-18750?: Medium severity, with a CVSS score of 5.3, published 12 August 2026.
Which products and versions are affected?: CERTCC VINCE before 3.0.44.
Is there a fix for CVE-2026-18750?: A patch was published on 2026-08-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18750 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18750?: Check whether you run CERTCC VINCE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An insecure direct object reference (IDOR) vulnerability exists in the ModifyEmailNotifications view in vinny/views.py. The view fetches a VinceCommEmail record by a raw primary key from the URL parameter without verifying that the requesting group-admin has authorization to access that record. An attacker with vendor-admin privileges can craft requests with arbitrary VinceCommEmail IDs to toggle the email_function or email_name fields for contacts belonging to other vendors. The vulnerability allows both information disclosure (reading email addresses and notification settings) and unauthorized modification of notification routing. A patch is available in version 3.0.44.

Affected products

CERTCC VINCE before 3.0.44

Timeline

2026-08-12: disclosed
2026-08-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.