CVE-2026-18749

The CVE-2026-18749 entry describes a logic flaw in the VINCE project: the type=track branch authorises access based solely on _is_my_case(t_attach.case) and does not check VinceTrackAttachment.shared. Consequently, a coordinator-uploaded case artefact that has NOT been marked as shared can still ...