CVE-2026-8406: openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mailid value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
openSIS Classic/messaging modulefrom your environment.Uninstall or remove the messaging module if it is not required to eliminate the insecure direct object reference exposure.
- Configuration
If the messaging feature is not required, disable the messaging module to remove access to modules/messaging/SentMail.php.
openSIS Classic (messaging module) messaging_enabled = false - Configuration
Restrict messaging-module access so only appropriately privileged roles (e.g., administrators) can view sent messages; remove general authenticated-user access to sent-message details.
openSIS Classic (messaging module) access_control = restrict to authorized roles only - Compensating control
Block or filter requests to modules/messaging/SentMail.php at the edge (web application firewall, reverse proxy, or web server) or restrict access to the messaging module to trusted IPs/networks to prevent arbitrary authenticated users from retrieving sent-message details.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8406?
CVE-2026-8406 has a high severity rating of 7.1 according to the CVSS 4.0 scoring system.
What does CVE-2026-8406 affect?
CVE-2026-8406 affects openSIS Classic version 9.3, specifically the messaging module.
How can an attacker exploit CVE-2026-8406?
An attacker can exploit CVE-2026-8406 by using an authenticated account to access sent message details through an arbitrary mail_id in the messaging module.
How do I fix CVE-2026-8406?
To fix CVE-2026-8406, update to the latest version of openSIS Classic that addresses this vulnerability.
What are the potential impacts of CVE-2026-8406?
The potential impacts of CVE-2026-8406 include unauthorized access to sensitive message details by authenticated users.