The CVSS 6.5 rating for CVE-2026-18744 obscures what this vulnerability actually does: it breaks the coordinated vulnerability disclosure (CVD) process itself, not just an access control check.
The technical flaw is an authorization bypass in a CVD platform where test_func verifies that the requester belongs to a case but never checks whether they own the specific member ID they're querying. This conflates two distinct concepts — collaborative access to a case versus hierarchical control over its participants. The share_status function, which gates disclosure timing, can be circumvented entirely by targeting the member-level endpoint rather than the case-level path. This is not a missing check; it's evidence that share_status was added after the original authorization model without auditing existing access paths for consistency.
The consequence is not one attacker reading one record. Embargoed data — affected/not-affected status, CaseStatements, vendor positions — flows to CERTs, national coordinators, and peer vendors who act on it as legitimate coordination information. When a participant harvests this data before public disclosure, they gain temporal advantage over the entire coordination timeline. They know which statements are most contested, when to publish, how to frame their narrative. This is not opportunistic exploitation; it's information harvesting with strategic intent against a population whose threat model assumes trusted participants.
More critically, this flaw severs the feedback loop that makes embargo enforcement possible. The CVD model assumes violations are detectable — you can identify when someone broke embargo, adjust coordination positions, calibrate trust. This vulnerability makes defection invisible. There is no audit trail saying 'member X accessed member Y's embargoed statement' because the authorization model treats both as legitimate case participants. The system cannot detect or prove the agreement was broken.
What to check: audit every endpoint that handles member-level data within a case context. If other endpoints apply case-level checks without member ownership verification, they likely have the same gap. The patch adds a member.owner == requester check to test_func — but this should trigger a broader permission model review, not a single-endpoint fix. Run authorization tests assuming every participant is adversarial, because in CVD, they are.