Auth bypass in Os4ed Opensis-Classic

CVE-2026-8406

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (14.7th percentile) — read the EPSS interpretation.