high7.1
CVE-2026-8406
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module.
Impact
openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.