CVE-2026-32867 identifies a security flaw in OPEXUS eComplaint software versions before 10.1.0.0, where an unauthenticated attacker can bypass authorization controls by exploiting a user-controlled key mechanism related to case numbers. Specifically, the vulnerability resides in the 'Portal/EEOC/DocumentUploadPub.aspx' endpoint, which allows attackers to upload arbitrary files to complaint cases by guessing or obtaining valid case numbers. This is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-425 (Direct Request). The attacker does not need valid credentials but must interact with the system to upload files. Uploaded files appear in the targeted cases, potentially confusing users and corrupting case data integrity. Additionally, uploading a large volume of files can lead to storage exhaustion, impacting system availability. The vulnerability does not disclose sensitive information directly but compromises data integrity and availability. No patches or exploits are currently documented, but the risk remains due to the ease of exploitation (no authentication required) and the potential for denial-of-service through resource consumption. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability allows attackers to inject arbitrary files into complaint cases, undermining the integrity of case data and potentially misleading users or administrators. This can disrupt complaint processing workflows and damage organizational trust in the system. The ability to upload many files can exhaust storage resources, causing denial-of-service conditions that degrade availability of the eComplaint platform. Although confidentiality is not directly impacted, the integrity and availability issues can have significant operational consequences, especially for organizations relying on eComplaint for regulatory or legal case management. Attackers could also use this vector as a foothold for further attacks, such as uploading malicious files or triggering application errors. The impact is particularly critical for organizations handling sensitive or high-volume complaint data, where data integrity and system uptime are paramount.

Organizations should upgrade OPEXUS eComplaint to version 10.1.0.0 or later where this vulnerability is addressed. In the absence of an immediate patch, implement strict access controls to restrict access to the 'DocumentUploadPub.aspx' endpoint, such as IP whitelisting or VPN-only access. Employ input validation and verify case numbers server-side to prevent unauthorized file uploads. Monitor file upload activity for anomalies, including unusual volume or unexpected file types. Implement storage quotas and automated cleanup policies to mitigate storage exhaustion risks. Conduct regular audits of uploaded files to detect unauthorized content. Additionally, consider deploying web application firewalls (WAFs) with custom rules to block unauthorized upload attempts. Educate users to report unexpected files appearing in cases promptly. Finally, maintain up-to-date backups to recover from potential data integrity issues caused by exploitation.