Description

vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T22:17:15.043Z",
  "pubdate": "2026-08-12T22:17:15.043Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the ModifyEmailNotifications function located within vinny/views.py.\nThe vulnerability allows an authenticated attacker, specifically a vendor administrator, to read and modify email notification settings, including email addresses and names, for contacts belonging to other vendor accounts.\nThe root cause is the direct retrieval of VinceCommEmail database records using raw primary keys supplied directly from the URL without validating whether the requested record's associated contact belongs to the currently authenticated requesting group-admin.\nSuccessful exploitation enables unauthorized data exposure and arbitrary modification of notification routing parameters across vendor boundaries.\nThe risk implication is a compromise of data confidentiality and integrity, allowing malicious or unauthorized vendors to intercept or misdirect communications intended for other organizational contacts.\nExploitation requires network access to the application and valid authentication credentials of a vendor admin, combined with the ability to enumerate or guess sequential or targeted primary keys within the URL path.",
  "technicalDetails": "The vulnerability resides in the ModifyEmailNotifications function within the vinny/views.py file, which handles the updating and retrieval of notification routing configurations.\nWhen a request is processed, the vulnerable endpoint extracts a raw primary key directly from the incoming URL parameters.\nThe application subsequently queries the database to fetch the VinceCommEmail record using this raw primary key value without implementing an authorization check to verify ownership.\nSpecifically, the backend logic fails to confirm whether the contact associated with the retrieved VinceCommEmail instance falls under the jurisdiction or management scope of the requesting group-admin.\nStep-by-step attack flow: First, an authenticated attacker with vendor-admin privileges identifies the endpoint associated with ModifyEmailNotifications. Second, the attacker crafts or modifies HTTP requests targeting arbitrary primary key values in the URL corresponding to VinceCommEmail records of other vendors. Third, the application processes the request, retrieves the target record regardless of ownership, and returns or updates the sensitive fields email_function and email/name. Finally, the attacker successfully reads sensitive recipient information or redirects notification routing for foreign vendor contacts.\nThe vulnerable component is the database query and access control logic in vinny/views.py.\nAuthentication is required to reach the endpoint, and the attacker must possess standard group-admin or vendor-admin privileges, making this an elevation of privilege and horizontal authorization bypass vulnerability.\nPost-exploitation impact includes unauthorized reading of sensitive email configurations, operational disruption via misrouted notifications, and potential social engineering or interception vectors resulting from altered communication channels."
}