CVE-2026-18749

The CVE-2026-18749 issue is a logic flaw in the track branch: authorization is performed via is_my_case(t_attach.case) and does not verify VinceTrackAttachment.shared. As a result, a coordinator-uploaded case artefact that has not been marked as shared remains retrievable by any case member who p...