{"id":"CVE-2026-126766","kind":"vulnerability","aliases":["CVE-2026-126766"],"related":[],"title":"OpsTree REMS: authenticated users can falsify incident reporter attribution","description":"OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.","summary":"OpsTree REMS through 1.0.0 trusts a client-supplied reporter field when creating or updating incidents. An authenticated user can record an incident as reported by someone else, corrupting the audit trail.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["incident-management","ops-tree-rems","other","self-hosted"],"not_affected_if":["unauthenticated-only-access"],"how_to_check":"- Check whether the installed REMS version is `1.0.0` or earlier\n- Look for the incident API endpoints `POST /api/v1/incidents` and `PATCH /api/v1/incidents/{id}/status` in your deployment\n- Confirm whether the reporter field is accepted from the client rather than set from the session","fix":null,"status":"open","published_at":"2026-11-11T19:17:36+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","triaged_at":"2026-11-11T19:30:31+00:00","updated_at":"2026-11-11T19:30:31+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T19:30:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpsTree REMS: authenticated users can falsify incident reporter attribution","impact":"low","summary":"OpsTree REMS through 1.0.0 trusts a client-supplied reporter field when creating or updating incidents. An authenticated user can record an incident as reported by someone else, corrupting the audit trail.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ops-tree-rems","incident-management","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"incident records falsely attributed to other users, audit trail corrupted","analyst_note":"Confirm the fixed version and whether a patch exists at the vulncheck advisory or the OpsTree REMS repository.","how_to_check":"- Check whether the installed REMS version is `1.0.0` or earlier\n- Look for the incident API endpoints `POST /api/v1/incidents` and `PATCH /api/v1/incidents/{id}/status` in your deployment\n- Confirm whether the reporter field is accepted from the client rather than set from the session","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"who_is_affected":"Teams that run OpsTree REMS for incident management, where users have accounts and can create or update incidents. The flaw affects attribution and audit integrity rather than direct access to data, so unauthenticated exposure is not described. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":4606,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126766':12A,15A '-2026':11A,14A '/api/v1/incidents':94C,97C '/status':99C '1.0.0':30B,62C 'account':108C 'allow':69C 'anoth':79C 'attack':89C 'attribut':9A,104C 'audit':57B,109C 'authent':3A,44B,70C 'author':66C 'client':34B,85C 'client-control':84C 'client-suppli':33B 'contain':63C 'control':86C 'corrupt':55B,106C 'craft':92C 'creat':39B 'cve':10A,13A 'els':54B 'falsifi':6A,102C 'field':37B,88C 'host':26B 'id':98C 'improp':65C 'incid':7A,17B,42B,49B,75C,103C 'incident-manag':16B 'manag':18B 'op':20B 'ops-tree-rem':19B 'opstre':1A,27B,59C 'patch':96C 'post':93C 'record':47B 'rem':2A,22B,28B,60C 'report':8A,36B,51B,77C,87C 'request':100C 'self':25B 'self-host':24B 'send':91C 'set':73C 'someon':53B 'suppli':35B,82C 'trail':58B,110C 'tree':21B 'trust':31B 'updat':41B 'user':4A,45B,71C,80C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Teams that run OpsTree REMS for incident management, where users have accounts and can create or update incidents. The flaw affects attribution and audit integrity rather than direct access to data, so unauthenticated exposure is not described. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["incidentmanagement","medium","opstreerems","other","selfhosted"],"campaign_type":null,"search_a":"'-126766':12A,15A '-2026':11A,14A 'attribut':9A 'authent':3A 'cve':10A,13A 'falsifi':6A 'incid':7A 'opstre':1A 'rem':2A 'report':8A 'user':4A","search_b":"'1.0.0':30B 'audit':57B 'authent':44B 'client':34B 'client-suppli':33B 'corrupt':55B 'creat':39B 'els':54B 'field':37B 'host':26B 'incid':17B,42B,49B 'incident-manag':16B 'manag':18B 'op':20B 'ops-tree-rem':19B 'opstre':27B 'record':47B 'rem':22B,28B 'report':36B,51B 'self':25B 'self-host':24B 'someon':53B 'suppli':35B 'trail':58B 'tree':21B 'trust':31B 'updat':41B 'user':45B","search_c":"'/api/v1/incidents':94C,97C '/status':99C '1.0.0':62C 'account':108C 'allow':69C 'anoth':79C 'attack':89C 'attribut':104C 'audit':109C 'authent':70C 'author':66C 'client':85C 'client-control':84C 'contain':63C 'control':86C 'corrupt':106C 'craft':92C 'falsifi':102C 'field':88C 'id':98C 'improp':65C 'incid':75C,103C 'opstre':59C 'patch':96C 'post':93C 'rem':60C 'report':77C,87C 'request':100C 'send':91C 'set':73C 'suppli':82C 'trail':110C 'user':71C,80C 'vulner':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126766","severity":null,"published_at":"2026-11-11T19:17:36+00:00","modified_at":"2026-11-11T19:17:36+00:00","first_seen_at":"2026-11-11T19:28:46+00:00","fetched_at":"2026-11-11T19:28:46+00:00","note":null}],"documents":[{"id":128096,"url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-reporter-spoofing-via-api-v1-incidents","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}