CVE-2026-28515

Katalog CVE

CVSS 8.8 · High EPSS 2,1%

Kerentanan Missing Authorization pada opendcim. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opendcim/openDCIM/pull/1664 issue tracking · patch
• https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 issue tracking · patch
• https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/ exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php advisory pihak ketiga
• https://github.com/Chocapikk/opendcim-exploit exploit
• https://github.com/opendcim/openDCIM/blob/4467e9c4/container-install.php#L421-L435 product
• https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L293 product
• https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434 product