CVE-2026-18750

The CVE-2026-18750 issue affects vinny/views.py in the ModifyEmailNotifications path, where an IDOR flaw allows fetching VinceCommEmail by a raw primary key from the URL and toggling email_function/name without verifying that the contact belongs to the requesting vendor-admin’s group. This could ...

CVE-2026-18750 CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...