CVE-2026-22230 OPEXUS eCASE Audit incorrect access control
Authenticated attackers can bypass administrative restrictions to access disabled functions or modify client-side JavaScript in OPEXUS eCASE Audit.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22230?
CVE-2026-22230 is a high-severity missing authorization vulnerability in OPEXUS eCASE Audit, published on 8 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. Fixed in eCASE Platform 11.14.1.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-22230?
It affects 1 product.
Products include Opexustech Ecase Audit.
How do I fix CVE-2026-22230?
No fix has been published for CVE-2026-22230 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-22230 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22230 exists.
Other vulnerabilities in OPEXUS eCASE Audit
Sources
Also known as GHSA-mc6v-g8qv-fwmp.