PatchSiren debrief for CVE-2026-18750: Insecure direct object reference (IDOR) vulnerability in vinny/views.py allows a vendor admin to toggle notification routing or read email/name for another vendor's contact. This issue arises from the view fetching VinceCommEmail by raw pk from URL without checking if the record's contact belongs to the requesting group-admin, potentially allowing unauthorized change [truncated]
CVE-2026-18749 debrief based on the supplied source corpus. The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared, allowing unauthorized access to case artifacts. This vulnerability affects defenders managing case artifacts and VinceTrackAttachment instances, who should assess exposure and prioritize mitigation. The CVE record and NVD entry provid [truncated]
