CVE-2026-8406 describes an insecure direct object reference vulnerability in openSIS Classic 9.3's messaging module. Authenticated users with access to the messaging feature can supply arbitrary mail_id values to modules/messaging/SentMail.php to retrieve sent message details without proper authorization checks. This represents an authorization bypass (CWE-639) that compromises message confidentiality within the application. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An authenticated user can access sent message details that they should not be authorized to view by manipulating the mail_id parameter. This leads to unauthorized disclosure of potentially sensitive message content within the openSIS Classic 9.3 environment. The vulnerability does not require user interaction and has low attack complexity, increasing the risk of unauthorized data access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the messaging module to trusted users only and monitor for suspicious activity related to message retrieval. Avoid exposing the application to untrusted networks where possible.