The vulnerability identified as CVE-2026-18750 in CERT/CC's VINCE product involves an Insecure Direct Object Reference (IDOR) due to improper authorization checks. Specifically, the ModifyEmailNotifications view fetches VinceCommEmail objects by primary key from the URL and toggles email_function or name fields without confirming that the contact is associated with the requesting group-admin. This lack of verification enables a vendor admin to alter notification routing or access email and name details of contacts from other vendors, constituting an authorization bypass as classified under CWE-639.

An attacker with vendor admin privileges can manipulate email notification settings or access personal information (email and name) of contacts belonging to other vendors. This could lead to unauthorized disclosure of contact information and potential disruption or redirection of email notifications across vendor boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict vendor admin privileges carefully and monitor for unauthorized access attempts. Implement additional authorization checks to ensure that group-admins can only access and modify contacts within their own vendor scope.