CVE-2026-126766
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.