CVE-2026-22234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22234", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "state": "PUBLISHED", "assignerShortName": "cisa-cg", "dateReserved": "2026-01-06T22:00:07.262Z", "datePublished": "2026-01-08T17:12:39.035Z", "dateUpdated": "2026-03-10T20:39:28.330Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files."}], "affected": [{"vendor": "OPEXUS", "product": "eCase Portal", "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "9.0.45.0", "versionType": "custom"}, {"version": "9.0.45.0", "status": "unaffected"}]}], "problemTypes": [{"descriptions": [{"description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE", "cweId": "CWE-639"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T18:28:08.843618Z", "id": "CVE-2026-22234", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "OPEXUS eCasePortal unauthenticated IDOR", "references": [{"name": "url", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22234", "tags": ["vdb-entry"]}, {"name": "url", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json", "tags": ["government-resource", "third-party-advisory"]}], "credits": [{"value": "Zach Crosman, CISA", "lang": "en"}], "datePublic": "2026-01-08T00:00:00.000Z", "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2026-01-08T18:28:29.580Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T20:39:20.513451Z", "id": "CVE-2026-22234", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:39:28.330Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T20:39:20.513451Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T20:39:25.308Z"}}], "cna": {"title": "OPEXUS eCasePortal unauthenticated IDOR", "credits": [{"lang": "en", "value": "Zach Crosman, CISA"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-22234", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-08T18:28:08.843618Z"}}}], "affected": [{"vendor": "OPEXUS", "product": "eCase Portal", "versions": [{"status": "affected", "version": "0", "lessThan": "9.0.45.0", "versionType": "custom"}, {"status": "unaffected", "version": "9.0.45.0"}], "defaultStatus": "unknown"}], "datePublic": "2026-01-08T00:00:00.000Z", "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2026-22234", "name": "url", "tags": ["vdb-entry"]}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json", "name": "url", "tags": ["government-resource", "third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2026-01-08T18:28:29.580Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22234", "state": "PUBLISHED", "dateUpdated": "2026-03-10T20:39:28.330Z", "dateReserved": "2026-01-06T22:00:07.262Z", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "datePublished": "2026-01-08T17:12:39.035Z", "assignerShortName": "cisa-cg"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "eCase Portal", "vendor": "OPEXUS", "versions": [{"lessThan": "9.0.45.0", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "9.0.45.0"}]}], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opexustech:ecase_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "925D4EE5-4C8E-43F6-9F2E-5DC1CB429F9D", "versionEndExcluding": "9.0.45.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files."}, {"lang": "es", "value": "OPEXUS eCasePortal anterior a la versi\u00f3n 9.0.45.0 permite a un atacante no autenticado navegar al endpoint 'Attachments.aspx', iterar a trav\u00e9s de valores predecibles de 'formid', y descargar o eliminar todos los archivos subidos por el usuario, o subir nuevos archivos."}], "id": "CVE-2026-22234", "lastModified": "2026-06-17T10:19:36.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}], "ssvcV203": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "ssvcData": {"id": "CVE-2026-22234", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T18:28:08.843618Z", "version": "2.0.3"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22234", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T20:39:20.513451Z", "version": "2.0.3"}}]}, "published": "2026-01-08T18:16:00.380", "references": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Broken Link"], "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-02.json"}, {"source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-22234"}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:34:33.296405+00:00", "value": {"mitigation_remediation": ["Upgrade OPEXUS eCasePortal to version 9.0.45.0 or later to eliminate the IDOR flaw.", "Configure the web application to require authentication and enforce role\u2011based access controls for the Attachments.aspx endpoint, so only authorized users can download, delete or upload files.", "Validate the formid request parameter and implement checks to prevent enumeration of object identifiers, ensuring that only objects belonging to the requesting user are accessible."], "summary": {"action": "Immediate Patch", "impact": "Insecure Direct Object Reference enabling unauthenticated download, deletion, or upload of user files"}, "threat_synthesis": {"affected_systems": "OPEXUS eCasePortal versions prior to 9.0.45.0 are affected. Attacks target the Attachments.aspx endpoint exposed by the application, as documented by the vendor\u2019s product listing.", "description_and_impact": "The vulnerability is an IDOR that allows an attacker without authentication to use the Attachments.aspx endpoint, iterating predictable formid values to access files uploaded by users. This flaw gives the attacker read, write, and delete capabilities over user\u2011uploaded content, potentially exposing confidential documents, corrupting data integrity, or disrupting access for legitimate users. The weakness is classified under CWE-639, which describes improper authorization of access to resources based on direct object references.", "risk_and_exploitability": "The CVSS base score of 9.3 denotes critical severity. EPSS indicates a very low exploitation probability (<1%) and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, the flaw can be exploited by simply navigating to a known endpoint with predictable parameters. Based on the description, it is inferred that the attack requires minimal technical skill and does not require privileged access, making the risk notable for any unpatched deployment."}}}}, "created": "2026-01-09T13:24:24.746542+00:00", "updated": "2026-04-18T07:45:24.974953+00:00", "vendors": ["opexus", "opexus$PRODUCT$ecase_portal"]}