CVE-2026-22234: OPEXUS eCasePortal unauthenticated IDOR
Published Jan 8, 2026
·Updated
OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.
Affected Software
2 affected components
OPEXUS eCasePortal<9.0.45.0
Opexustech Ecase Portal<9.0.45.0
Event History
Jan 8, 2026
CVE Published
via MITRE·05:12 PM
Data Sourced
via MITRE·05:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-22234?
CVE-2026-22234 has a high severity due to its potential to allow unauthenticated attackers to access sensitive user-uploaded files.
2
How do I fix CVE-2026-22234?
To mitigate CVE-2026-22234, upgrade OPEXUS eCasePortal to version 9.0.45.0 or later as soon as possible.
3
What types of attacks are possible due to CVE-2026-22234?
CVE-2026-22234 allows attackers to download, delete, or upload files by exploiting the 'Attachments.aspx' endpoint.
4
What software versions are affected by CVE-2026-22234?
Versions of OPEXUS eCasePortal prior to 9.0.45.0 are affected by CVE-2026-22234.
5
Is authentication required to exploit CVE-2026-22234?
No, CVE-2026-22234 can be exploited by unauthenticated attackers.