External risk intelligence

openDCIM Installer Missing Authorization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-28515

openDCIM is a web-based data center infrastructure management tool. While these systems are typically deployed within internal network environments to manage hardware, they are web applications accessible via network and could be exposed to the public internet in some configurations, particularly if misconfigured or intended for remote management.

Opendcim

23.04

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in openDCIM, a data center infrastructure management tool, that allows any authenticated user to modify application settings. This issue stems from the installer and upgrade functions not properly checking user roles, potentially enabling unauthorized configuration changes. In certain deployment scenarios, this could even be accessible without credentials.

Unauthenticated users can change system settings.
It impacts data center infrastructure management software.
Confirm relevance and assess potential unauthorized access.

Attack Path

How an attacker could exploit the issue

An attacker could gain access to openDCIM's installation and upgrade scripts, specifically `install.php` and `container-install.php`, if these are exposed. Even without specific privileges, an authenticated user or potentially unauthenticated users in certain configurations could manipulate LDAP settings. This would allow for unauthorized changes to the application's configuration.

Entry: Exposed installer scripts.
Trigger: Modifying LDAP settings.
Risk: Unauthorized application configuration changes.

Live Threat

Current exploitation, exposure, and threat context

An authorization vulnerability in openDCIM's installation and upgrade scripts could allow unauthorized modifications to LDAP configurations. This could occur when the `REMOTE_USER` environment variable is set without proper authentication enforcement, potentially enabling modifications to application settings without needing to be a privileged user.

LDAP configuration data at risk.
Unauthorized access via installer scripts.
Application configuration could be altered.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts openDCIM deployments, specifically the installer and upgrade scripts, allowing any authenticated user to modify LDAP configurations without proper authorization checks. If `REMOTE_USER` is used without authentication enforcement, it may be exploitable without any credentials. The immediate first step is to locate all openDCIM instances, verify their exposure, and identify the responsible team for remediation planning.

Application owners and platform teams own remediation.
Verify instance exposure and reachability first.
Plan configuration reviews and patching by owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is openDCIM?

openDCIM is a web-based application designed for data center infrastructure management. It helps organizations track and manage hardware, assets, and power usage within their physical data centers.

What is the vulnerability in CVE-2026-28515?

This vulnerability is classified as CWE-862, or missing authorization. In plain terms, the software fails to verify if a user has permission to perform sensitive tasks. Specifically, the installer and upgrade scripts do not check user roles, allowing users to alter critical application settings like LDAP configurations without authorization.

How can an attacker trigger this issue?

An attacker triggers this by accessing the install.php or container-install.php scripts. While the bug generally requires an existing user account to access the settings, it can be triggered without any credentials at all in deployments where the REMOTE_USER environment variable is trusted without enforcing actual authentication.

Is my openDCIM installation at risk?

Halo Surface Signal notes that while these tools are typically used on internal networks to manage hardware, they are web-based. If your instance is reachable over the internet—perhaps for remote management—or if your authentication configuration is loose, you are more likely to be affected by this authorization flaw.

How do I respond to CVE-2026-28515?

Start by identifying all instances of openDCIM running in your environment to understand your footprint. Once mapped, confirm their network reachability and coordinate with your internal platform or application owners to review the security of these installation scripts and apply the appropriate updates to restore proper authorization checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.