{"cvss":0.0,"datePublished":"2026-05-14T00:00:00Z","dateUpdated":"2026-05-14T00:00:00Z","description":"openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.","dueDate":"","id":"CVE-2026-28515","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"opendcim","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"opendcim opendcim Missing Authorization","vendor":"opendcim"}