CVE-2026-8406CWE-639

openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail

High · published June 11, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-11T13:32Z
EPSS history
Timeline
  • 11 JUN 13:32Z
    openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
    cvelistv5