CyberRota Analysis
AI-GeneratedAuthenticated users can exploit a vulnerability to access sensitive CaseStatements and CaseMemberStatus information belonging to other vendors by manipulating member IDs. This flaw allows unauthorized data exposure, potentially leaking embargoed status and statement text across different tenants. Organizations utilizing the affected products should prioritize remediation to protect against data breaches and maintain compliance with data privacy regulations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.