CVE-2026-126772 · Other
NO FIX YET
OpsTree REMS through 1.0.0 lets an authenticated user post comments on incidents as the incident's creator through the comment API endpoint. An attacker with a low-privilege account can impersonate a Super User and alter the incident timeline and audit trail.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run OpsTree REMS for incident response are exposed when any user with a low-privilege account can reach the comment endpoint. The sources do not say which configurations or roles are affected beyond authenticated users, and they do not name a fixed version.
Not affected if unknown
Who cares incident-management, ops-tree-rems
1.0.0 and earlierPOST /api/v1/incidents/{incident_id}/comment for author attribution logicNo fix yet, per the sources.
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.