Is CVE-2026-8406 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8406 being exploited in the wild.

How severe is CVE-2026-8406?

Informational severity, with a CVSS score of 7.1, published 11 June 2026.

Is there a fix for CVE-2026-8406?

A patch was published on 2026-06-11: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8406 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8406?

Check whether you run OS4ED openSIS Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8406: OS4ED openSIS Classic IDOR in messaging module

CVE-2026-8406 · Severity: info · CVSS 7.1 · Published 2026-06-11

openSIS Classic, a student information system used by schools to manage academic records and communications, contains a security flaw in its messaging module. An authenticated user, such as a student or staff member, can view private messages sent by other users by simply changing a message ID in their web browser. This could lead to the unauthorized exposure of sensitive school communications and personal information.

Technologies: OS4ED openSIS Classic. Vendors: OS4ED.

Quick answers

Is CVE-2026-8406 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8406 being exploited in the wild.
How severe is CVE-2026-8406?: Informational severity, with a CVSS score of 7.1, published 11 June 2026.
Which products and versions are affected?: OS4ED openSIS Classic 9.3.
Is there a fix for CVE-2026-8406?: A patch was published on 2026-06-11: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8406 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8406?: Check whether you run OS4ED openSIS Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in openSIS Classic 9.3 within the messaging module. The flaw is located in 'modules/messaging/SentMail.php', where the application fails to perform adequate authorization checks when a user requests message details. By supplying an arbitrary 'mail_id' value in the request, any authenticated user with access to the messaging module can bypass intended access controls to view sent-message details and download attachments belonging to other users. A patch has been committed to the official repository to enforce proper authorization checks in 'SentMail.php' and 'DownloadWindow.php'.

Affected products

OS4ED openSIS Classic 9.3

Timeline

2026-06-11: advisory: NVD and Fluid Attacks published the advisory
2026-06-11: disclosed
2026-06-11: patched: Fix committed to GitHub repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.