CVE-2026-126766: OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpsTree REMS user can exploit it. The attacker needs permission to submit incident creation or incident status update requests to the affected API endpoints.
What actions can an attacker perform?
An attacker can supply a client-controlled reporter value when sending POST requests to /api/v1/incidents or PATCH requests to /api/v1/incidents/{id}/status. This can attribute an incident to another user and compromise the accountability audit trail.
Which versions are affected?
OpsTree REMS through version 1.0.0 is affected.