External risk intelligence

VinceTrack Attachment Sharing Vulnerability Leaks Unmarked Case Material.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18749

The vulnerability exists within the VINCE platform, a specialized system used primarily for coordinated vulnerability disclosure between researchers, vendors, and coordinators. While network-reachable, it operates within private, authenticated collaboration workflows rather than being a public-facing service or internet edge gateway, making broad public exposure uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability affecting the VINCE platform, which handles sensitive case information for coordinated vulnerability disclosure. The issue allows case members to access unshared case artifacts using a unique identifier, potentially exposing pre-release information to vendors.

Unauthorized access to sensitive, unreleased case data.
Critical flaw; exposure of early-stage disclosures.
Verify relevance and assess any potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could access sensitive information by leveraging a flaw in how case artifacts are authorized. By obtaining the unique identifier (UUID) of a case artifact, even one not intended for sharing, an attacker could retrieve it. This allows for the leakage of unreleased coordinator materials to vendors associated with the case, potentially exposing sensitive data before it's officially shared.

No authentication required.
Retrieve shared or unshared artifacts via UUID.
Exposes unreleased sensitive material.

Live Threat

Current exploitation, exposure, and threat context

The system could expose case artifacts that have not been explicitly shared, allowing any case member with the artifact's UUID to retrieve them. This risk is supported when coordinator-uploaded artifacts are not marked as shared.

Not-yet-released coordinator material.
Case members retrieve via UUID.
Exposure of sensitive, unreleased data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in VINCE affects case artifact retrieval, potentially exposing unreleased coordinator material to vendors. Action is required by the VINCE platform administrators or the security team responsible for its operation. The immediate first step should be to confirm the VINCE deployment's scope, identify the specific case members and vendors involved, and assess the business criticality of the affected artifacts to prioritize remediation.

VINCE administrators should own this issue.
Verify artifact sharing and case member access.
Plan vendor notification and artifact review.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VINCE platform?

VINCE is a specialized collaboration platform designed to manage coordinated vulnerability disclosure. It provides a secure environment for researchers, software vendors, and coordinators to share sensitive information, track vulnerability reports, and communicate during the lifecycle of a security disclosure process.

How does CWE-639 manifest in CVE-2026-18749?

This vulnerability is an Authorization Bypass Through User-Controlled Key, or CWE-639. In this case, the system fails to verify the shared status of an attachment, trusting a user-provided UUID instead. Because the software does not enforce the specific 'shared' permission check, it incorrectly grants access to private case materials that were never intended for general case members.

Does knowing a file's UUID always trigger this bug?

Not necessarily. The vulnerability is triggered specifically when a coordinator uploads an artifact and fails to mark it as shared. If the coordinator correctly flags an artifact as shared, standard authorization processes apply. The bug specifically affects material intended to remain private to the coordinator, which becomes accessible only if the user possesses the correct UUID.

Is my VINCE instance at risk of exposure?

Halo Surface Signal notes that while VINCE is network-reachable, it is generally used for private, authenticated collaboration rather than as a public-facing gateway. Your risk level depends on whether your organization operates a VINCE instance and allows access to participants who might attempt to retrieve artifacts they were not explicitly granted permission to see.

What steps should I take if I run VINCE?

Start by identifying your organization's VINCE deployment and auditing current case permissions. Because this is a logic flaw in how artifacts are authorized, prioritize reviewing case artifacts that contain sensitive, unreleased coordinator material. Collaborate with your security team to verify existing sharing settings and ensure that only authorized parties can access critical disclosure data.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.