The vulnerability arises because VINCE versions 3.0.38 and earlier do not properly verify the authenticity of the From address when processing incoming emails. This misinterpretation of encoding allows an attacker to craft an email that appears to come from a trusted source, causing the system to perform automated actions such as ticket creation or updates without proper authorization. The impact is the ability to create, modify, or delete tickets in the system, leading to potential data integrity and confidentiality problems.

VINCE email processing system from CERT/CC. Versions 3.0.38 and earlier are affected.

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available. Despite the lack of public exploitation metrics, the flaw allows an attacker to bypass authentication checks by sending fraudulent emails to the system, which can be performed remotely over the network. Because the exploit requires only the ability to send an email address to the system, the attack vector is likely remote and does not demand local access. The potential for widespread unauthorized ticket manipulation makes it a high‑severity risk.