CVE-2026-126766 · Other
NO FIX YET
OpsTree REMS through 1.0.0 trusts a client-supplied reporter field when creating or updating incidents. An authenticated user can record an incident as reported by someone else, corrupting the audit trail.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run OpsTree REMS for incident management, where users have accounts and can create or update incidents. The flaw affects attribution and audit integrity rather than direct access to data, so unauthenticated exposure is not described. The sources do not name a fixed version.
Not affected if unauthenticated-only-access
Who cares incident-management, ops-tree-rems, self-hosted
1.0.0 or earlierPOST /api/v1/incidents and PATCH /api/v1/incidents/{id}/status in your deploymentNo fix yet, per the sources.
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.