CVE-2026-28515

216.73.217.22

· Published 27/02/2026 23:16 · Modified 27/02/2026 23:16

Labels: CVE-2026-28515 2026-02-27 CVE-2026-28515 CWE-862 [email protected]

Essential information

Published: 27/02/2026 23:16
Modified: 27/02/2026 23:16
Author: —
Creator: —
CVSS: 9.3 CRITICAL (v3) 9.3 CRITICAL (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
opendcim / opendcim	`cpe:2.3:a:opendcim:opendcim::::::::`