CVE-2026-18750

Medium

Description

vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.

SeverityMedium

CVSS5.3

Exploit probability—

ProductVINCE

PublishedAug 12, 2026

First seenAug 12, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

CERT/CC VINCE3.0.44 or later

Affected products

Product	Affected versions	Fixed in
CERT/CC VINCE	v < 3.0.44	3.0.44

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.