CVE-2026-126766

OpsTree REMS versions through 1.0.0 are affected by an improper authorization vulnerability (CWE-639) regarding incident reporting. An authenticated user can spoof a reporter's identity by supplying a client-controlled reporter field within crafted POST /api/v1/incidents or PATCH /api/v1/incident...