UNKNOWN NVD

CVE-2026-18744

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.

References

https://github.com/CERTCC/VINCE
https://github.com/CERTCC/VINCE/pull/235

Published: 2026-08-12 · Source: NVD · Feed updated: 2026-08-13

This unknown severity vulnerability was published on 2026-08-12 via NVD.

vulnfeed aggregates 10530 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.