Medium 5.3

OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows...

CVE-2026-126772 First seen on SecPulse Nov 12, 03:11

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
OpsTree Solutions	OpsTree SolutionsREMS	≤ 1.0.0→ Not listed	Not listed

This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.

Original description The description as published by the source.

OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4: Medium 5.3; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Nov 12, 2026
First seen on SecPulse: Nov 12, 03:11
GHSA: GHSA-r36g-vg5x-pxjg
CWE: CWE-863

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-863

All

Opstree Solutions Rems

Detection sources

NIST National Vulnerability Database09:20
GitHub Security Advisories (Global)Nov 12, 06:33
CVE.org (CVE Program・cvelistV5)09:00