PT-2026-22425 · Opendcim · Opendcim

Valentin Lobstein · Published 2026-02-27 · Updated 2026-05-19 · CVE-2026-28515

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openDCIM version 23.04 through commit 4467e9c4

Description The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. This allows any authenticated user to access the functionality regardless of their assigned privileges. In deployments where REMOTE USER is set without authentication enforcement, the endpoints "install.php" and "container-install.php" may be accessible without credentials, enabling unauthorized modification of the application configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07989

CVE-2026-28515

Affected Products

Opendcim

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28515.json · Exploit
• 🔥 https://github.com/Chocapikk/opendcim-exploit · Exploit
• 🔥 https://chocapikk.com/posts/2026/opendcim-sqli-to-rce · Exploit
• https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 · Patch
• https://github.com/opendcim/openDCIM/pull/1664 · Patch
• https://osv.dev/vulnerability/CVE-2026-28515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28515 · Security Note
• https://bdu.fstec.ru/vul/2026-07989 · Security Note
• https://github.com/opendcim/openDCIM · Note
• https://github.com/opendcim/openDCIM/pull/1664/commits/8f7ab2a710086a9c8c269560793e47c577ddda09 · Note
• https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434 · Note
• https://github.com/opendcim/openDCIM/blob/4467e9c4/container-install.php#L421-L435 · Note
• https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L293 · Note
• https://vulncheck.com/advisories/opendcim-missing-authorization-in-install-php · Note
• https://twitter.com/Chocapikk_/status/2027525689491193901 · Twitter Post