Auth bypass in Os4ed Opensis-classic

CVE-2026-8406

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supp…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.