{"id":"CVE-2026-18750","aliases":["EUVD-2026-57632","GHSA-j5jq-5w3c-xc48"],"status":"published","title":"CVE-2026-18750","description":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00325,"percentile":0.25895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-08-12T21:09:15Z","modified":"2026-10-28T02:31:11Z","products":[{"vendor":"cert/cc","product":"vince"}],"references":[{"url":"https://certcc.github.com/CERTCC/VINCE/","tags":["web"]},{"url":"https://github.com/CERTCC/VINCE/pull/235","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18750","tags":["advisory"]},{"url":"https://certcc.github.com/CERTCC/VINCE"},{"url":"https://github.com/advisories/GHSA-j5jq-5w3c-xc48"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18750.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-18750","title":"CVE-2026-18750","description":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.","status":"published","published":"2026-08-12T21:09:15.989Z","modified":"2026-08-13T15:47:52.245Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-57632","description":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.","status":"published","published":"2026-08-12T21:09:15Z","modified":"2026-08-13T15:47:52Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:56.066325Z"}],"ghsa":[{"id":"GHSA-j5jq-5w3c-xc48","title":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL...","description":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.","status":"published","published":"2026-08-13T00:31:25Z","modified":"2026-08-13T18:32:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:10:26.766632Z"}],"nvd":[{"id":"CVE-2026-18750","description":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.","status":"published","published":"2026-08-12T22:17:15.043Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-18750","title":"CVE-2026-18750","description":"vinny/views.py: (ModifyEmailNotifications)\tIDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.","status":"published","published":"2026-08-12T21:09:15.989Z","modified":"2026-10-28T02:31:11.655970047Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:58.024074Z"}]}}