CVE-2026-18749

This CVE exposes coordinator-level materials — pre-release strategy, pricing leverage, vendor selection rationale — to unauthorized vendors through a missing attribute check in VinceTrackAttachment retrieval. The vulnerability isn't a simple coding oversight; it's the fingerprint of an authorization model that evolved through incremental additions rather than unified design. The core mechanism: UUID-based direct retrieval enforces case membership but skips the `shared` attribute check that segments coordinator content from vendor-visible material. When the `type=track` code path was written, the developer implemented the obvious gate (case membership) and stopped — the `shared` check that exists in sibling paths wasn't surfaced as a required condition for this branch. For defenders, three actions matter immediately. First, verify whether your instance has any `type=track` attachments and audit their `shared` status — if any were shared with vendors before this is patched, treat them as potentially compromised. Second, add the `shared` check to the retrieval function, but recognize this will break existing workflows where coordinators generated UUIDs assuming case membership alone was the gate; you will need to identify and notify users who built automation around that assumption. Third, recognize this pattern isn't likely unique: the architecture that produced it — implicit secondary authorization attributes enforced inconsistently across code paths — will generate similar gaps in other object types if left unchecked. The CVSS 9.8 reflects not technical sophistication but blast radius: the information exposed is strategic intelligence (pre-decision materials, pricing strategy), not operational data. The exposure window dates from when the vulnerable branch merged, not from disclosure — coordinator workflows that involved sharing materials with vendors during that window may have already extended the exploitation surface.

Reviewed through automated stages and approved by a human before publication.