CVE-2026-28515
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
openDCIM version 23.04 up to commit 4467e9c4 has a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges.
Risk Assessment
Unauthorized modification of LDAP configuration could lead to compromise of organizational authentication, allowing an attacker to access sensitive data or systems. In deployments with REMOTE_USER set without authentication enforcement, the endpoint may be accessible without any credentials.
Recommendation
Immediately update openDCIM to a version containing the fix (beyond commit 4467e9c4) or manually secure install.php and container-install.php by adding role-based access controls. In the meantime, restrict access to these files using firewall rules or web server configuration.
Other vulnerabilities in openDCIM
See all- CVE-2026-28517Critical
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization.
- CVE-2026-28516High
openDCIM version 23.04 up to commit 4467e9c4 contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
Original NVD description (English source)
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.