Skip to content
OpenAdvisories
Critical VA-26-008-02 2 CVEs

OPEXUS eComplaint and eCasePortal IDOR

Published Jan 7, 2026 · Updated Jan 7, 2026

Vendor: OPEXUS Product: eCase Portal Product: eComplaint

Summary

OPEXUS eCasePortal and eComplaint before version 9.0.45.0 allow an unauthenticated attacker to iterate through predictable URL parameters and download all available files. The eCasePortal vulnerability allows attackers to upload and delete files as well.

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-22234

    OPEXUS eCasePortal unauthenticated IDOR

    OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.

    OPEXUS eCase Portal
  • High 7.5
    CVE-2026-22235

    OPEXUS eComplaint IDOR

    OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.

    OPEXUS eComplaint

Revision history

  1. #1.0.0

    Initial publication