The vulnerability in VINCE’s type=track branch allows a user to retrieve attachments that have not been marked as shared. By omitting the shared flag check, any case member who knows an attachment’s UUID can access it. This bypass undermines the confidentiality controls intended for coordinator‑uploaded material, potentially exposing not‑yet‑released information to all members on the case. This is an improper access control flaw and privilege escalation via permission chains (CWE‑639).

Affected systems are any installations of the VINCE project, as modified by CERT/CC:VINCE. Version information is not specified in the advisory, so all releases using the current type=track implementation are potentially vulnerable. The flaw resides in the authorisation logic, not in the underlying storage, meaning any deployment that incorporates the unpatched code is at risk.

The exploitability is high because the required input—the UUID of an attachment—is typically known or can be intercepted between members. The vulnerability is a pure authorisation flaw; no remote code execution or elevated privilege is required. The CVSS score of 9.8 indicates critical severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild, yet the risk of confidential data exposure remains significant for any organization using VINCE with shared‑tracking unprotected.