CVE-2026-28515CWE-862

openDCIM <= 23.04 Missing Authorization in install.php

Critical · published February 27, 2026

CVSS v4.0
9.3
EPSS
2%
Percentile
81.7
In the wild
Unconfirmed
What it is

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02118 · 81.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-27T22:11Z
EPSS history
Timeline
  • 27 FEB 22:11Z
    openDCIM <= 23.04 Missing Authorization in install.php
    cvelistv5