CVE-2026-18744

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated case participant can retrieve the CaseStatement and CaseMemberStatus of other vendors by providing the specific member's id. This occurs because the test func function only verifies if the user is part of the case via is my case but fails to verify ownership of the member variable. This flaw allows a user to bypass the share status setting, leading to the cross-tenant leak of embargoed vendor information, including whether a vendor is affected and the associated statement text.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.