CVE-2026-8406

openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail

CVSS 7.1 HIGHEPSS 0.2%CWE-639

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

11 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Productos afectados

OS4ED · openSIS-Classic

Referencias

https://fluidattacks.com/es/advisories/melanie https://github.com/OS4ED/openSIS-Classic https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f