What is CVE-2026-18750?
CVE-2026-18750 is an IDOR vulnerability in vinny/views.py. The ModifyEmailNotifications view fetches a VinceCommEmail by raw pk from the URL and toggles email_function/name without verifying that the record's contact belongs to the requesting group-admin, allowing a vendor admin to flip notification routing or read email/name for another vendor's contact.
Azərbaycanca: CVE-2026-18750 IDOR (Insecure Direct Object Reference) zəifliyidir. Bu, vinny/views.py-də ModifyEmailNotifications funksiyasında aşkarlanıb, burada görünüş URL-dən xam pk ilə VinceCommEmail obyektini gətirir və qeydin əlaqəsinin sorğu göndərən qrup admininə aid olduğunu yoxlamadan email_function/name-i dəyişir. Bu, vendor admininə başqa vendorun kontaktının bildiriş marşrutunu dəyişməyə və ya e-poçt/adını oxumağa imkan verir.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
In which function was CVE-2026-18750 discovered?
In the ModifyEmailNotifications function in vinny/views.py.
What can an attacker achieve with CVE-2026-18750?
Read the email/name or flip notification routing for another vendor's contact.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.