CyberRota Analysis
AI-GeneratedThe vulnerability allows a vendor admin to manipulate email notification settings for contacts belonging to other vendors by exploiting an insecure direct object reference (IDOR) in the `ModifyEmailNotifications` function. This could lead to unauthorized access to sensitive information, such as email addresses and notification preferences, potentially compromising the privacy of affected contacts. Organizations with vendor management systems should prioritize addressing this issue to prevent data leakage and maintain compliance with privacy standards.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.