CVE-2026-18750: Vinny/views.py (ModifyEmailNotifications) vulnerability
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18750?
CVE-2026-18750 has a severity score of 48, indicating a moderate risk level.
How do I fix CVE-2026-18750?
To fix CVE-2026-18750, implement authorization checks to ensure that a user can only modify email notifications for contacts within their own group.
What types of attacks can CVE-2026-18750 allow?
CVE-2026-18750 can allow unauthorized users to alter email notification settings or access email and name information for contacts belonging to other vendor admins.
What is the impact of CVE-2026-18750?
The impact of CVE-2026-18750 includes potential data leakage and unauthorized alteration of notification preferences for sensitive contacts.
Which component is affected by CVE-2026-18750?
CVE-2026-18750 affects the vinny/views.py file specifically within the ModifyEmailNotifications function.