CVE-2026-18744 CVE-2026-18744

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — testfunc only checks ismycase, not ownership of kwargs'member'. Bypasses sharestatus; leaks embargoed vendor affected/not-affected + statement text cross-tenant...

CVE-2026-18744

CVE-2026-18744: In authenticated scenarios, a case participant can retrieve another vendor’s CaseStatement and per-vul CaseMemberStatus by supplying the member’s id, because the test function only checks _is_my_case and not ownership of kwargs['member']. This bypasses share_status and leads to cr...