# CVE-2026-8406: OS4ED openSIS Classic IDOR in messaging module

Source: https://junglewise.ai/threats/cve-2026-8406-os4ed-opensis-classic-idor-in-messaging-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-8406 · Severity: info · CVSS 7.1 · Published 2026-06-11

openSIS Classic, a student information system used by schools to manage academic records and communications, contains a security flaw in its messaging module. An authenticated user, such as a student or staff member, can view private messages sent by other users by simply changing a message ID in their web browser. This could lead to the unauthorized exposure of sensitive school communications and personal information.

Technologies: [OS4ED openSIS Classic](https://junglewise.ai/threats/technologies/opensis-classic). Vendors: [OS4ED](https://junglewise.ai/threats/vendors/os4ed).

## Quick answers

**Is CVE-2026-8406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8406 being exploited in the wild.

**How severe is CVE-2026-8406?** Informational severity, with a CVSS score of 7.1, published 11 June 2026.

**Which products and versions are affected?** OS4ED openSIS Classic 9.3.

**Is there a fix for CVE-2026-8406?** A patch was published on 2026-06-11: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8406 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8406?** Check whether you run OS4ED openSIS Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in openSIS Classic 9.3 within the messaging module. The flaw is located in 'modules/messaging/SentMail.php', where the application fails to perform adequate authorization checks when a user requests message details. By supplying an arbitrary 'mail_id' value in the request, any authenticated user with access to the messaging module can bypass intended access controls to view sent-message details and download attachments belonging to other users. A patch has been committed to the official repository to enforce proper authorization checks in 'SentMail.php' and 'DownloadWindow.php'.

## Affected products

- OS4ED openSIS Classic 9.3

## Timeline

- 2026-06-11: advisory: NVD and Fluid Attacks published the advisory
- 2026-06-11: disclosed
- 2026-06-11: patched: Fix committed to GitHub repository

## References

- [https://fluidattacks.com/es/advisories/melanie](https://fluidattacks.com/es/advisories/melanie)
- [https://github.com/OS4ED/openSIS-Classic](https://github.com/OS4ED/openSIS-Classic)
- [https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f](https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f)

## Related threats

- [openSIS Classic insecure direct object reference in staff password reset](https://junglewise.ai/threats/cve-2026-91107-opensis-classic-9-3-allows-an-authenticated-user-with-the-built)
- [OS4ED openSIS-Classic SQL injection in Save Data Handler](https://junglewise.ai/threats/cve-2026-103117-a-security-vulnerability-has-been-detected-in-os4ed-opensis)
- [OS4ED openSIS-Classic SQL injection in student list search](https://junglewise.ai/threats/cve-2026-103116-a-weakness-has-been-identified-in-os4ed-opensis-classic-up-to-9)
- [OS4ED openSIS-Classic SQL injection in Student Search](https://junglewise.ai/threats/cve-2026-103115-a-security-flaw-has-been-discovered-in-os4ed-opensis-classic-up)
- [OS4ED openSIS-Classic SQL injection in Assignment Management](https://junglewise.ai/threats/cve-2026-103114-a-vulnerability-was-identified-in-os4ed-opensis-classic-up-to-9)