CVE-2026-18750

Name of the Vulnerable Software and Affected Versions vinny (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists in the ModifyEmailNotifications function within vinny/views.py. The view retrieves a VinceCommEmail record using a raw primary key (pk) from the URL and modifies the email function or name variables without verifying if the associated contact belongs to the requesting group administrator. This allows a vendor administrator to read the email or name, or change the notification routing, for contacts belonging to other vendors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.