Which versions of PHP are affected by CVE-2026-28515?

openDCIM versions through 23.04 contain a critical authorization flaw that could allow attackers to gain complete control of data center infrastructure systems and access sensitive configuration…. A patch is available.

Is there a public PoC exploit available for CVE-2026-28515?

Yes, a public proof-of-concept exploit is available for CVE-2026-28515. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-28515?

Within 24 hours, identify and inventory all openDCIM deployments in your environment to determine which are running version 23.04 or earlier. Within 7 days, apply the available vendor security patch to all affected instances, validate that services restart successfully, and confirm that authorization controls are functioning correctly. Within 30 days, audit database and LDAP configuration access logs to detect any unauthorized access attempts or configuration changes that occurred during the exposure period.

PHP CVE-2026-28515

Q: What is the CVSS score of CVE-2026-28515?

CVE-2026-28515 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Missing Authorization (CWE-862)

2026-02-27 disclosure@vulncheck.com

PHP Authentication Bypass Opendcim

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 19:33 vuln.today

Analysis Updated

Jul 14, 2026 - 19:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

Jul 14, 2026 - 19:22 NVD

8.8 (HIGH) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 10, 2026 - 15:03 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 15:03 nvd

Patch available

CVE Published

Feb 27, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

AnalysisAI

Missing authorization in openDCIM 23.04 (through commit 4467e9c4) lets any authenticated user — regardless of assigned role — reach LDAP configuration handling in install.php and container-install.php, and where REMOTE_USER is trusted without real authentication enforcement the endpoints may be reachable with no credentials at all. Because the same installer path also chains into a SQL injection in the configuration-update routine and a command injection in report_network_map.php (both fixed in the same PR), the broken access control is a stepping stone to full remote code execution. Publicly available exploit code exists (Chocapikk's 'SQLi to RCE' write-up and PoC); EPSS is low at 0.22% (44th percentile) and the CVE is not listed in CISA KEV, so no confirmed active exploitation.