CVE-2026-22234: OPEXUS eCasePortal unauthenticated IDOR in Attachments.aspx
OPEXUS eCasePortal versions before 9.0.45.0 are affected by an insecure direct object reference (CWE-639) that the record says can be reached without authentication. According to the record, an attacker could access, delete or upload user files through the Attachments.aspx endpoint. No confirmed exploitation appears in the sources consulted, and the record lists no fix entries.
Overview
OPEXUS eCasePortal before 9.0.45.0 contains an insecure direct object reference (IDOR), catalogued as CWE-639 (Authorization Bypass Through User-Controlled Key). The record states that the flaw is reachable through the Attachments.aspx endpoint and relies on predictable identifiers, with no authentication required.
Impact
- Confidentiality: the record states that all user-uploaded files could be downloaded.
- Integrity: the record states that files could be deleted or new files uploaded.
- Scores: the CISA CNA record shows CVSS v3.1 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 9.3.
- SSVC: the record lists technical impact as total and automatable as yes.
Affected products and versions
- The record lists two product names: OPEXUS eCase Portal and Opexustech Ecase Portal, both with versions before 9.0.45.0.
- The record contains no fix entries. The boundary 9.0.45.0 is the upper limit of the listed affected range, so it is the most likely first unaffected release, but this is an inference that should be confirmed with the vendor.
Exploitation status
The record shows KEV listing as false, so no active exploitation is confirmed by CISA KEV. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none, and the EPSS probability is recorded as 0.00408 (percentile 0.33969). These figures do not guarantee future activity.
Remediation and mitigation
- Inventory all installations of eCasePortal and record their exact versions.
- Plan an upgrade to version 9.0.45.0 or a later release, after confirming the fixed build with the vendor.
- Restrict network exposure of the portal and place it behind strong access controls until patched.
- Review stored attachments for unexpected deletions or unknown files.
Detection guidance
- Review web server and application logs for requests to Attachments.aspx from unauthenticated sessions.
- Look for unusual request volumes or sequential variation in identifier parameters, which may indicate enumeration.
- Monitor for unexpected delete or upload events on attachment storage.
Limitations of the available information
- The record lists no fixed versions or patch references.
- The CSAF advisory link is tagged as broken in the record, so vendor advisory details could not be verified.
- The record does not describe the exact request conditions, the vendor's assessment, or any observed exploitation.
- The EPSS date in the record should be read as recorded, not independently verified.
Frequently asked questions
What is the core weakness in CVE-2026-22234?
The record classifies it as an insecure direct object reference (CWE-639), where access to files depends on predictable identifiers rather than enforced authorization checks.
Is this vulnerability known to be exploited in the wild?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none.
Which versions are affected?
The record lists versions before 9.0.45.0 for both OPEXUS eCase Portal and Opexustech Ecase Portal. Confirm the fixed build with the vendor because no fix entries are listed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.