CVE-2026-126772
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.