EUVD-2026-57633

The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...

CVE-2026-18749 CVE-2026-18749

The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...

CVE-2026-18749

The CVE-2026-18749 entry describes a logic flaw in the VINCE project: the type=track branch authorises access based solely on _is_my_case(t_attach.case) and does not check VinceTrackAttachment.shared. Consequently, a coordinator-uploaded case artefact that has NOT been marked as shared can still ...