Which versions of openSIS Classic are affected by CVE-2026-8406?

openSIS Classic 9.3 contains a messaging module vulnerability allowing authenticated users to access other employees' confidential sent communications through parameter manipulation.

How to fix or mitigate CVE-2026-8406?

Within 24 hours: inventory all openSIS Classic 9.3 installations with messaging module enabled and identify which users have access. Within 7 days: restrict messaging module access to essential personnel only and implement comprehensive audit logging for all module interactions. Within 30 days: monitor vendor communications for security patch release and deploy immediately upon availability; alternatively, evaluate if custom build from published upstream GitHub fix is operationally feasible.

openSIS Classic CVE-2026-8406

Q: What is the CVSS score of CVE-2026-8406?

CVE-2026-8406 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36245 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-11 help@fluidattacks.com

GHSA-vgf3-fpxc-h968

Authentication Bypass PHP

7.1

CVSS 4.0 · Vendor: fluidattacks

Severity by source

Vendor (fluidattacks) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable PHP endpoint, trivially scriptable IDOR requiring any authenticated messaging-module user (PR:L), no UI, leaks message contents only - high confidentiality, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (fluidattacks).

CVSS VectorVendor: fluidattacks

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 11, 2026 - 14:32 vuln.today

Analysis Generated

Jun 11, 2026 - 14:32 vuln.today

DescriptionCVE.org

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

AnalysisAI

Authenticated information disclosure in openSIS Classic 9.3 lets any logged-in user with messaging-module access read other users' sent messages by tampering with the mail_id parameter sent to modules/messaging/SentMail.php. The flaw is a textbook insecure direct object reference (CWE-639) with no public exploit identified at time of analysis, though the upstream commit fixing it is published on GitHub, effectively documenting the vulnerable code path.

Technical ContextAI

openSIS Classic is an open-source PHP-based student information system maintained by OS4ED. The vulnerable endpoint modules/messaging/SentMail.php reads $_REQUEST['mail_id'] and interpolates it directly into a SQL query against the msg_outbox table without verifying that the requesting user is the message's owner - the classic CWE-639 (Authorization Bypass Through User-Controlled Key) pattern. The upstream commit c45d4314 confirms the root cause: the fix introduces sqlSecurityFilter() on mail_id and, more importantly, joins login_authentication and adds AND from_user='$userName' AND lg.user_id = $user_id AND lg.profile_id = User('PROFILE_ID') clauses so the row is only returned when it actually belongs to the caller (with student profiles using UserStudentID() instead of UserID()). The same commit applies an analogous ownership check to DownloadWindow.php, indicating the missing-ownership-predicate pattern was systemic in this codebase.

RemediationAI

Upstream fix available (commit c45d43146167324bae06bdf09de3e4bd2e5e478f); released patched version not independently confirmed, so administrators should either cherry-pick that commit or track the OS4ED/openSIS-Classic repository (https://github.com/OS4ED/openSIS-Classic) for the next tagged release that includes it. Until the fix is applied, viable compensating controls include disabling the messaging module in modules.php for deployments that do not actively use internal mail (eliminates the attack surface but removes a feature staff may rely on), restricting access to /modules/messaging/SentMail.php via a web-server ACL or WAF rule that requires the role 'admin'/'teacher' (reduces exposure from student/parent accounts but does not protect against a malicious low-privileged staff account), and tightening account provisioning so that anonymous self-registration cannot create an authenticated session. Refer to the Fluid Attacks advisory (https://fluidattacks.com/es/advisories/melanie) for vendor-coordinated details.