Description

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-12T22:17:14.933Z",
  "pubdate": "2026-08-12T22:17:14.933Z",
  "executiveSummary": "An access control vulnerability exists within the track branch authorization mechanism of VinceTrackAttachment.\nThe vulnerability allows unauthorized retrieval of coordinator-uploaded case artefacts that have not been explicitly marked as shared.\nAffected systems include the VinceTrackAttachment component where case-level attachment retrieval operations are processed.\nThe risk implications involve the unauthorized exposure of confidential, not-yet-released coordinator material to external vendors participating on the case.\nAttacker capabilities are limited to case members who possess or obtain the specific universally unique identifier (UUID) of the unshared artefact.\nExploitation requires valid case membership and knowledge or interception of the target artefact UUID, bypassing intended sharing restrictions due to improper authorization checks.",
  "technicalDetails": "The root cause of the vulnerability stems from incomplete authorization logic within the type=track branch.\nSpecifically, the component exclusively authorizes access based on _is_my_case(t_attach.case) evaluations and fails to validate the VinceTrackAttachment.shared attribute or flag.\nThe vulnerable component is the attachment retrieval routing logic handling track branch requests associated with VinceTrackAttachment records.\nAuthentication requirements dictate that the attacker must be an authenticated case member, but privilege requirements are otherwise minimal since standard case membership grants access to the flawed code path.\nThe exploitation method relies on direct reference attacks via UUID enumeration or leakage.\nThe step-by-step attack flow proceeds as follows: First, a coordinator uploads an artefact to a case via VinceTrackAttachment without marking the item as shared.\nSecond, the unshared artefact is assigned a UUID within the system.\nThird, a malicious or curious case member obtains the UUID of the unshared artefact through direct communication, logging, or enumeration.\nFourth, the user crafts a request targeting the track branch using the obtained UUID.\nFifth, the backend executes the authorization check, which only validates that the requesting user is associated with the case via _is_my_case(t_attach.case).\nSixth, because the missing check on VinceTrackAttachment.shared is omitted, the system bypasses the intended restriction and successfully returns the unshared artefact.\nPost-exploitation impact includes the compromise of sensitive coordinator materials, unauthorized information disclosure, and breach of confidentiality boundaries between coordinators and vendors."
}