High · 7.1 CVE-2026-8406 EUVD-2026-36245GHSA-vgf3-fpxc-h968

openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail

Published Jun 11, 2026 · Updated Jun 11, 2026 · Assigned by Fluid Attacks

Description

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

Affected products

Vendor	Product	Affected	Fixed
OS4ED	openSIS-Classic	9.3	—

References

https://fluidattacks.com/es/advisories/melanie third-party-advisory
https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f patch
https://github.com/OS4ED/openSIS-Classic product