Vulnerability · Published Jun 11, 2026 · Assigned by Fluid Attacks
CVE-2026-8406openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
High 7.1
In plain English
A high-severity authorization bypass via user-controlled key in openSIS-Classic from OS4ED. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.3%top 76.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OS4ED | openSIS-Classic | 9.3 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N