OpsTree REMS: Comment author spoofing via incident comment API
Summary
OpsTree REMS through 1.0.0 lets authenticated users post comments on incidents they do not own. The comment is recorded as made by the incident creator, such as a Super User. An attacker with a low-privileged account can therefore falsify incident timelines and audit trails, which undermines accountability. No confidentiality or availability impact has been demonstrated.
Affected
- REMS 0 through 1.0.0 (CNA record: VulnCheck)
- Researcher advisory: all versions prior to the patched release
Fixed in
- Patched by OpsTree Solutions according to the researcher advisory
- Fixed version: Unknown.
Workaround
- Unknown. No vendor workaround has been published.
- Restrict REMS accounts to known staff until a fix is installed.
Exploitation
- Aggregator data lists the issue as not known to be exploited.
- The CVE record references a public GitHub gist, which may contain proof-of-concept material. Its contents have not been verified.
- Exploitation requires a valid REMS account, no user interaction and network access to REMS.
Our recommendation
- Check whether REMS is deployed, which version is in use and whether it is reachable from the internet.
- Ask OpsTree for the fixed version and install it as soon as it is available.
- Until then, limit REMS accounts to known staff and review existing accounts.
- Do not rely on comment authorship in incident timelines and audit logs for incidents with comments from non-owners.
- Monitor the NVD record, as the scores differ between sources (CNA CVSS v4.0 5.3, VulDB 6.3, CVSS v3.1 4.3 cited by a researcher).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126772 www.cve.org
- VulnCheck advisory: OpsTree REMS comment author spoofing www.vulncheck.com
- Researcher advisory REMS-CVE-15 (GitHub gist) gist.github.com
- OpsTree REMS product page opstree.com
- VulDB entry CVE-2026-126772 vuldb.com
- Strix CVE entry CVE-2026-126772 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:46.
Original description (NVD)
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.