CVE-2026-8406

openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail

CVSS 7.1 HIGHEPSS 0.2%CWE-639

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

11 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

OS4ED · openSIS-Classic

Referências

https://fluidattacks.com/es/advisories/melanie https://github.com/OS4ED/openSIS-Classic https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f