CVE-2026-32865

critical · 9.2

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.

9.2

CVSS

0.3%

EPSS (exploit prob.)

24th

EPSS percentile

2026-03-19

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-200CWE-640

Affected products

Vendor	Product	Affected versions
opexustech	ecase_ecomplaint	< 10.1.0.0

Check a specific version with /api/v1/cve/match.

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-077-01.json
https://www.cve.org/CVERecord?id=CVE-2026-32865

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-32865