Insecure Direct Object Reference in OPEXUS eCasePortal Allows File Manipulation

Publication date: 2026-01-08

Last updated on: 2026-02-18

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-08

Last Modified

2026-02-18

Generated

2026-07-06

AI Q&A

2026-01-08

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22234

EUVD

EUVD-2026-1486

Affected Vendors & Products

Vendor	Product	Version / Range
opexustech	ecase_portal	to 9.0.45.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to access the 'Attachments.aspx' endpoint and use predictable 'formid' values to download, delete, or upload user files without authorization.

Impact Analysis

An attacker exploiting this vulnerability can gain unauthorized access to user-uploaded files, potentially leading to data theft, data loss, or unauthorized data modification by deleting or uploading files.

Hi! I’m here to help you understand CVE-2026-22234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70