# CVE-2026-18750: CERTCC VINCE ModifyEmailNotifications insecure direct object reference

Source: https://junglewise.ai/threats/cve-2026-18750-certcc-vince-modifyemailnotifications-insecure-direct-object  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18750 · Severity: medium · CVSS 5.3 · Published 2026-08-12

VINCE is a vulnerability coordination and disclosure platform used by organizations to manage vendor notifications and communications. A flaw in the email notification settings allows a vendor administrator to modify or read email notification preferences for contacts belonging to other vendors, potentially disrupting critical notification routing or exposing sensitive contact information.

Technologies: [CERTCC VINCE](https://junglewise.ai/threats/technologies/vince). Vendors: [CERTCC](https://junglewise.ai/threats/vendors/certcc).

## Quick answers

**Is CVE-2026-18750 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18750 being exploited in the wild.

**How severe is CVE-2026-18750?** Medium severity, with a CVSS score of 5.3, published 12 August 2026.

**Which products and versions are affected?** CERTCC VINCE before 3.0.44.

**Is there a fix for CVE-2026-18750?** A patch was published on 2026-08-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18750 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18750?** Check whether you run CERTCC VINCE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insecure direct object reference (IDOR) vulnerability exists in the ModifyEmailNotifications view in vinny/views.py. The view fetches a VinceCommEmail record by a raw primary key from the URL parameter without verifying that the requesting group-admin has authorization to access that record. An attacker with vendor-admin privileges can craft requests with arbitrary VinceCommEmail IDs to toggle the email_function or email_name fields for contacts belonging to other vendors. The vulnerability allows both information disclosure (reading email addresses and notification settings) and unauthorized modification of notification routing. A patch is available in version 3.0.44.

## Affected products

- CERTCC VINCE before 3.0.44

## Timeline

- 2026-08-12: disclosed
- 2026-08-13: patched

## References

- [https://certcc.github.com/CERTCC/VINCE/](https://certcc.github.com/CERTCC/VINCE/)
- [https://github.com/CERTCC/VINCE/pull/235](https://github.com/CERTCC/VINCE/pull/235)

## Related threats

- [CERT VINCE case statement cross-tenant information disclosure](https://junglewise.ai/threats/cve-2026-18744-cert-vince-case-statement-cross-tenant-information-disclosure)