CVE-2026-32867
Received Received - Intake

Unauthenticated File Upload in OPEXUS eComplaint Allows Storage Exhaustion

Publication date: 2026-03-19

Last updated on: 2026-03-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. Uploading a large number of files could consume storage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-19
Last Modified
2026-03-30
Generated
2026-07-07
AI Q&A
2026-03-19
EPSS Evaluated
2026-07-06
NVD
CVE-2026-32867
EUVD
EUVD-2026-13126

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opexustech ecase_ecomplaint to 10.1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-425 The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Mitigation Strategies

I don't know

Impact Analysis

The vulnerability can impact you by allowing unauthorized individuals to upload arbitrary files to your case management system without authentication.

This can lead to unexpected or malicious files appearing in cases, potentially causing confusion or misuse.

Furthermore, uploading a large number of files could exhaust storage capacity, potentially disrupting normal operations.

Compliance Impact

I don't know

Executive Summary

This vulnerability exists in OPEXUS eComplaint versions before 10.1.0.0. It allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files through the 'Portal/EEOC/DocumentUploadPub.aspx' endpoint.

As a result, users may see unexpected files appearing in their cases, which they did not upload or authorize.

Additionally, if an attacker uploads a large number of files, it could consume significant storage resources.

Detection Guidance

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart