# CVE-2026-45776: Open XDMoD broken access control in SUPReMM module

Source: https://junglewise.ai/threats/cve-2026-45776-open-xdmod-broken-access-control-in-supremm-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-45776 · Severity: info · CVSS 5.3 · Published 2026-06-05

Open XDMoD is a tool used by research institutions to track and analyze high-performance computing (HPC) usage. A security flaw in the system's access control logic allows an authenticated user to view the compute job performance and efficiency metrics of other users. This could lead to the unauthorized exposure of sensitive research activity data if the optional Job Performance (SUPReMM) module is installed.

Technologies: [UBCCR Open XDMoD](https://junglewise.ai/threats/technologies/open-xdmod). Vendors: [UBCCR](https://junglewise.ai/threats/vendors/ubccr).

## Quick answers

**Is CVE-2026-45776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45776 being exploited in the wild.

**How severe is CVE-2026-45776?** Informational severity, with a CVSS score of 5.3, published 5 June 2026.

**Which products and versions are affected?** UBCCR Open XDMoD < 11.0.3.

**Is there a fix for CVE-2026-45776?** A patch was published on 2026-05-12: Fixed in version 11.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45776 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45776?** Check whether you run UBCCR Open XDMoD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Open XDMoD's access control logic stems from the use of a client-controlled session variable for authorization decisions. By submitting a crafted HTTPS POST request, an authenticated attacker can manipulate this session variable to bypass intended data access restrictions. This issue specifically impacts deployments utilizing the optional Job Performance (SUPReMM) module, allowing unauthorized viewing of job efficiency metrics belonging to other users. The vulnerability is addressed in version 11.0.3; a manual patch is available for users unable to upgrade immediately.

## Affected products

- ubccr Open XDMoD < 11.0.3

## Timeline

- 2026-04-06: disclosed: Privately reported to the vendor
- 2026-05-12: patched: Fixed in version 11.0.3
- 2026-06-05: advisory: Public advisory and CVE published

## References

- [https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2](https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2)
- [https://github.com/ubccr/xdmod/security/advisories/GHSA-3hfh-m242-8rmh](https://github.com/ubccr/xdmod/security/advisories/GHSA-3hfh-m242-8rmh)
- [https://open.xdmod.org/security_patches/GHSA-3hfh-m242-8rmh-0_0_0-11_0_2.patch](https://open.xdmod.org/security_patches/GHSA-3hfh-m242-8rmh-0_0_0-11_0_2.patch)

## Related threats

- [ubccr Open XDMoD SQL injection in Metric Explorer](https://junglewise.ai/threats/cve-2026-45779-ubccr-open-xdmod-sql-injection-in-metric-explorer)
- [Open XDMoD reflected XSS in password reset functionality](https://junglewise.ai/threats/cve-2026-45778-open-xdmod-reflected-xss-in-password-reset-functionality)
- [ubccr Open XDMoD OS command injection](https://junglewise.ai/threats/cve-2026-45777-ubccr-open-xdmod-os-command-injection)