CVE-2026-126768

OpsTree REMS versions through 1.0.0 are vulnerable to an authentication bypass vulnerability. An unauthenticated attacker can gain SuperUser administrative access by sending a POST /api/v1/user/login/ request for the admin account. The attack is achieved by providing an invalid password while set...

CVE-2026-126766

OpsTree REMS versions through 1.0.0 are affected by an improper authorization vulnerability (CWE-639) regarding incident reporting. An authenticated user can spoof a reporter's identity by supplying a client-controlled reporter field within crafted POST /api/v1/incidents or PATCH /api/v1/incident...