Threats tagged 'ghsa-j5jq-5w3c-xc48'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.3%	CVE-2026-18750CERT/CC VINCE · Insecure Direct Object Reference Medium5.3EPSS 0.3%2026-08-12CVE Database V5CVE-2026-18750 vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact. EPSS 0.3%Vulnerability CWE-639 #ghsa-j5jq-5w3c-xc48	CVE Database V5	2026-08-12

Page 1 of 1