CVE-2026-76176: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in OCS Inventory NG Ocsreports

CVE-2026-76176 describes an SQL injection vulnerability in OCS Inventory NG's Ocsreports component. Specifically, the endpoint /ocsreports/index.php?function=admin_double improperly processes values in the ID field of the selected_grp_dupli[] parameter. This allows an authenticated operator-level user to alter SQL queries executed by the application, potentially retrieving sensitive data from the database. The vulnerability is identified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

An attacker with operator-level authentication privileges can exploit this vulnerability to manipulate backend SQL queries, potentially leading to unauthorized disclosure of sensitive database information. The CVSS 4.0 score is 8.6 (high severity), indicating significant impact due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict operator-level access to trusted users and monitor for suspicious activity related to the affected endpoint.