PT-2026-145399
CVE-2026-126772
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾