What is GHSA-vgf3-fpxc-h968?

GHSA-vgf3-fpxc-h968 is a security advisory published by GitHub Security Advisories with High severity. openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging...

Which CVE IDs does GHSA-vgf3-fpxc-h968 cover?

GHSA-vgf3-fpxc-h968 covers the following CVE IDs: CVE-2026-8406. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-vgf3-fpxc-h968High

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging...

Vendor

GitHub Security Advisories

Published

June 11, 2026

Last Modified

June 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-8406 →

📋 Description

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-8406
https://github.com/OS4ED/openSIS-Classic/commit/c45d43146167324bae06bdf09de3e4bd2e5e478f
https://fluidattacks.com/es/advisories/melanie
https://github.com/OS4ED/openSIS-Classic
https://github.com/advisories/GHSA-vgf3-fpxc-h968