CVE-2026-126772

OpsTree REMS versions through 1.0.0 is affected by an improper attribution vulnerability (CWE-863) in the Incident Comment API . This flaw allows authenticated, lower-privileged users to post comments via POST /api/v1/incidents/{incident_id}/comment while spoofing the identity of the incident cre...