Cert/cc Vince vulnerabilities

4 CVEs affecting Cert/cc Vince, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18750, published 2026-08-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18749, published 2026-08-12. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still…
CVE-2026-18744, published 2026-08-12. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of…
CVE-2026-18750, published 2026-08-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting…
CVE-2026-8142, published 2026-05-07. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket…