REMS vulnerabilities

2 known vulnerabilities in REMS from OpsTree Solutions. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  REMS: Missing Authentication for Critical Functionality

  CVE-2026-126769Nov 11, 2026OpsTree Solutions

  OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invali

• 9.8 Critical severity

  REMS: Improper Authentication

  CVE-2026-126768Nov 11, 2026OpsTree Solutions

  OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin acco