Description
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.
Published: 2026-02-27
Score: 9.3 Critical
EPSS: 45.1% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the install.php and container-install.php scripts of openDCIM 23.04. The installer exposes LDAP configuration interfaces without enforcing proper role checks. Consequently, any authenticated user, or in some cases an unauthenticated user when REMOTE_USER is set, can alter the application’s LDAP settings.

Affected Systems

The flaw affects the openDCIM 23.04 community edition. Any deployment that includes the specified commit 4467e9c4 and retains the default install.php and container-install.php files is vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 9.3 assigns the vulnerability a critical rating. With an EPSS of 45% the probability that exploitation occurs or will occur in the near term is high. The vulnerability is not listed in the CISA KEV catalog. Attackers can modify configuration files, specifically LDAP settings, through the web interface, and in environments where REMOTE_USER is enabled without authentication, no credentials are required to access the endpoint.

Generated by OpenCVE AI on June 7, 2026 at 16:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the fixed release of openDCIM or apply the patch from the official pull request 1664 that restores proper role checks.
  • Remove or rename the install.php and container-install.php scripts from the web root after installation to eliminate the installation entry points.
  • Configure the web server to enforce authentication for any remaining installation or upgrade URLs and restrict access to administrators only.

Generated by OpenCVE AI on June 7, 2026 at 16:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 02 Mar 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Opendcim
Opendcim opendcim
Vendors & Products Opendcim
Opendcim opendcim

Fri, 27 Feb 2026 22:30:00 +0000

Type Values Removed Values Added
Description openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.
Title openDCIM <= 23.04 Missing Authorization in install.php
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Opendcim Opendcim
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-11T23:11:31.383Z

Reserved: 2026-02-27T21:07:55.465Z

Link: CVE-2026-28515

cve-icon Vulnrichment

Updated: 2026-03-02T21:46:43.179Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-27T23:16:05.960

Modified: 2026-03-10T15:03:39.680

Link: CVE-2026-28515

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T17:00:05Z

Weaknesses