PT-2026-2172 · Opexus · Opexus Ecase+1

Aaron M. Ramirez + 3 · Published 2026-01-08 · Updated 2026-01-26 · CVE-2026-22230

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions OPEXUS eCASE Audit versions prior to 11.14.1.0

Description An authenticated attacker can modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. The issue involves incorrect access control.

Recommendations Update to eCASE Platform version 11.14.1.0 or later.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-22230

Affected Products

Opexus Ecase

Ecase Platform

References · 9

• https://osv.dev/vulnerability/CVE-2026-22230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22230 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22230 · Security Note
• https://twitter.com/VulmonFeeds/status/2009492971528356310 · Twitter Post
• https://t.me/cveNotify/149930 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-008-01.json · Note
• https://twitter.com/CVEnew/status/2009462348197843158 · Twitter Post
• https://docs.opexustech.com/docs/eCase/11.14.X/eCASE_Release_Notes_11.14.1.0.pdf · Note
• https://t.me/CVEtracker/41749 · Telegram Post