CVE-2026-18749

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authorization flaw exists where the system only verifies the is my case(t attach.case) function and fails to check the VinceTrackAttachment.shared attribute. This allows any case member who possesses the uuid of a coordinator-uploaded case artefact to retrieve it, even if the artefact has not been marked as shared, potentially leaking unreleased coordinator material to vendors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.