CVE-2026-8142

CVE-2026-8142 PUBLISHED

Description (CNA)

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

Affected (CNA)

Vendor / product	Versions
CERT/CC / VINCE	affected * through 3.0.38

CWE

No CWE identifiers supplied.

References

https://kb.cert.org/vince
https://github.com/CERTCC/VINCE

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.