CVE-2026-8406: openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail

Synopsis

An insecure direct object reference (IDOR) vulnerability exists in the messaging module of openSIS Classic 9.3. Any authenticated user can retrieve sent-message details belonging to other users by manipulating the mail_id parameter in a direct HTTP request to SentMail.php, with no elevated privileges required beyond a basic account. Successful exploitation gives the attacker read access to private sent-mail contents across the application. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable SentMail.php endpoint is exposed over the network, so an attacker must be able to reach the application's HTTP interface.

• AuthenticationRequired

  Any low-privilege account with access to the messaging module is sufficient; no administrative role is needed.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no action by another user is required.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: incrementing or substituting an integer mail_id value in the request is all that is required.

Blast Radius

• The attacker reads the full contents of sent messages written by other users, including any personally identifiable or sensitive information those messages contain.
• By iterating over mail_id values, the attacker can enumerate the entire sent-mail history across all users of the application.
• No data modification or service disruption capability is granted by this vulnerability; impact is limited to confidentiality of stored messages.