Vulnerability status is missing option for Disputed vulnerability

[t8m]

In the selection for vulnerability status there are just 3 choices - Affected/Not Affected/Unknown. We would like to see another choice added - Disputed. We would like to apply this in case we agree that the seemingly vulnerable behavior as reported by the reporter is present but we disagree with the qualification as a security issue for any reason.

[Santoshkumarpuppala]

Supporting this from the reporter's side, with one request attached.

I've been on the receiving end of exactly the determination t8m describes: a maintainer agreed the behaviour I reported was present and worked the way I said, and concluded the broader access path was intended, so it wasn't a security issue. That was a legitimate call and I accepted it. But none of the three existing choices expressed it. "Not Affected" is false — the behaviour is there and both sides agree on it. "Affected" is the thing being denied. "Unknown" says the analysis didn't happen, when it did and carefully. So the gap is real, and it isn't only a vendor convenience: of the four values this would create, Disputed is the one a reporter can actually learn something from.

The request: if Disputed is added, make the reason a required companion rather than an optional note. In my experience these determinations resolve into a small number of recurring shapes — the actor was already entitled to the capability, the behaviour is only reachable through a supported path, the affected code was never in a shipped release — and a bare Disputed flag discards all of it. "Disputed, because the actor already had that access" changes what a reporter does next. "Disputed" on its own produces an argument, in my experience fairly reliably.

Worth checking against work already underway rather than settling here: CVEProject/cve-schema#140 has been developing a disputedReasonType enum with a free-text fallback, and the SPWG asked the QWG to move forward with it. VINCE and the CVE record format are describing the same event from two sides, and it would be a shame for the case tracker and the record to end up with different vocabularies for it.