CVE-2026-18749 CVE-2026-18749
Attackers can access unshared coordinator artifacts by guessing UUIDs, leaking sensitive data to unauthorized case members.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18749?
CVE-2026-18749 is a critical missing authorization vulnerability in CERT/CC VINCE, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.
Weakness: CWE-639
Which versions are affected by CVE-2026-18749?
How do I fix CVE-2026-18749?
No fix has been published for CVE-2026-18749 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-18749 being exploited?
There is no known exploitation of CVE-2026-18749 in the wild and no public exploit code.
Sources
Also known as GHSA-fmgm-gh7c-hwv2.