CVE-2026-8406

Description

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

PUBLISHED Reserved 2026-05-12 | Published 2026-06-11 | Updated 2026-06-11 | Assigner Fluid Attacks

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Credits

Daniel Celis finder

References

fluidattacks.com/es/advisories/melanie exploit

fluidattacks.com/es/advisories/melanie third-party-advisory

github.com/...ommit/c45d43146167324bae06bdf09de3e4bd2e5e478f patch

github.com/OS4ED/openSIS-Classic product

cve.org (CVE-2026-8406)

nvd.nist.gov (CVE-2026-8406)

Download JSON