The vulnerability resides in the install.php and container-install.php scripts of openDCIM 23.04. The installer exposes LDAP configuration interfaces without enforcing proper role checks. Consequently, any authenticated user, or in some cases an unauthenticated user when REMOTE_USER is set, can alter the application’s LDAP settings. This permits an attacker to manipulate critical configuration, potentially compromising data integrity and enabling further attacks if the new configuration includes privilege escalations or network pivoting capabilities.

The flaw affects the openDCIM 23.04 community edition. Any deployment that includes the specified commit 4467e9c4 and retains the default install.php and container-install.php files is vulnerable.

The CVSS v3.1 score of 9.3 assigns the vulnerability a critical rating. With an EPSS of 42 % the probability that exploitation occurs or will occur in the near term is high. The vulnerability is not yet listed in the CISA KEV catalog, but the lack of authorization checks allows attackers to modify configuration files and introduce arbitrary code or misconfigure services. Attackers can exploit it through the web interface, and in environments where REMOTE_USER is enabled without authentication, no credentials are required.