CVE-2026-18749

A vulnerability exists in the VinceTrack system where the type=track branch incorrectly authorizes access based only on _is_my_case(t_attach.case) without checking the VinceTrackAttachment.shared status. This flaw allows any case member who possesses or is sent the UUID of a coordinator-uploaded ...