High severity · published Jun 11, 2026
CVE-2026-8406
openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openSIS-Classic · OS4ED
9.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8406
fluidattacks.com
https://fluidattacks.com/es/advisories/melanie
github.com
https://github.com/OS4ED/openSIS-Classic
github.com
https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f
More from openSIS-Classic
9.8
CVE-2024-51211
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file
9.3
CVE-2026-91107
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
6.5
CVE-2026-11944
openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download
6.3
CVE-2026-103116
OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
6.3
CVE-2026-103115
OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection