CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthorized access to coordinator-uploaded case artifacts that have not been marked as shared, enabling any case member with the artifact's UUID to retrieve sensitive information. This could lead to the unintended disclosure of confidential materials to external vendors involved in the case. Organizations utilizing this system should prioritize addressing this issue to protect sensitive data from being leaked.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.