CVE-2026-8406 — openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request se…
Published: 2026-06-11 · CVSS: 7.1 · CVSS 4.0
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7