CVE-2026-126772: OpsTree REMS through 1.0.0 Comment Author Spoofing via Incident Comment API
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incidentid}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with lower privileges can exploit it. The attacker needs access to the incident comment API and an incident owned by another user, including a Super User.
What impact should responders expect?
An attacker can submit comments that appear to have been authored by the incident creator. This can corrupt incident timelines and audit trails, but the provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.
Which versions are affected?
OpsTree REMS through version 1.0.0 is affected.
How can teams look for signs of exploitation?
Review incident comments for entries attributed to incident creators, particularly privileged users, that do not match their known activity. Compare comment timestamps and API activity with the purported author's authentication or audit records where available.