OpsTree REMS: Reporter spoofing via incident API (improper authorization)
Summary
OpsTree REMS through 1.0.0 trusts a client-supplied reporter field when creating incidents or changing incident status. An authenticated user can attribute incidents to another user via crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests. The flaw affects integrity only: incident attribution and the accountability audit trail can be falsified, but no data is directly exposed and no takeover is described. Exploitation requires a valid REMS account.
Affected
- OpsTree Solutions REMS, versions 0 through 1.0.0
- Affected endpoints: POST /api/v1/incidents and PATCH /api/v1/incidents/{id}/status
- Fixed version: Unknown.
Fixed in
Unknown. The vendor reportedly acknowledged the issue and confirmed remediation, but no fixed version number is published in the sources reviewed.
Workaround
- No vendor-confirmed workaround.
- Restrict access to the incident creation and status-change APIs to trusted users.
- Limit REMS accounts to users who need them and keep the management interface off the public internet.
- Reconcile incident reporter fields against login logs.
Exploitation
- No known exploitation in the wild; no CISA KEV listing.
- A public proof of concept is unverified: one reference is tagged as a technical-description exploit, while VulDB reports no available exploit.
Our recommendation
- Check whether REMS is installed and which versions are in use.
- Update to a fixed version as soon as OpsTree publishes one; re-check the vendor page and NVD.
- Until patched, restrict REMS accounts and API access, and keep the interface off the internet.
- Monitor incident records for reporter values that do not match login logs.
- Also check CVE-2026-126768 (rated 9.8) if REMS is in use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126766 www.cve.org
- VulnCheck advisory www.vulncheck.com
- GitHub gist (REMS-CVE-10) gist.github.com
- VulDB CVE entry vuldb.com
- Offseq threat entry radar.offseq.com
- OpsTree REMS product page opstree.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:47.
Original description (NVD)
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.