CVE-2026-28515

HighCVSS 8.8/10Last modified Jul 14, 2026

Description

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
openDCIM	openDCIM	<= 23.04

References

https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/Exploit, Third Party Advisory
https://github.com/Chocapikk/opendcim-exploitExploit
https://github.com/opendcim/openDCIM/blob/4467e9c4/container-install.php#L421-L435Product
https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L293Product
https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434Product
https://github.com/opendcim/openDCIM/pull/1664Issue Tracking, Patch
https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09Issue Tracking, Patch
https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-phpThird Party Advisory

Timeline

Published: Feb 27, 2026
Last modified: Jul 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-285168.8openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and cont CVE-2026-285179.8openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application r CVE-2026-285187.8OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that all CVE-2026-285198.8arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer component. An attacker on the sam CVE-2026-28526.3A vulnerability was identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects the function addSales/CVE-2026-285208.4arduino-TuyaOpen before version 1.2.1 contains a single-byte buffer overflow vulnerability in the WiFiMulti component. When the victim's sma CVE-2026-285217.7arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component. An attacker who hijacks CVE-2026-285226.5arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. An attacker on the same lo CVE-2026-285256.8SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated atta CVE-2026-285265.7BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LIST_PLAYER_APPLICATION_SETT CVE-2026-285277.3BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller GET_PLAYER_APPLICATION_SETTI CVE-2026-285284.6BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handle