CVE-2026-18744

An authorization bypass vulnerability allows any authenticated case participant to fetch CaseStatement and CaseMemberStatus data belonging to other vendors. The root cause is that the test_func only verifies if the case belongs to the user (_is_my_case) but fails to validate ownership of the spec...