CVE-2026-8406 Incomplete Fix: Residual Message Authorization Bypasses

[arbor-s]

• Original fix commit: c45d43146167324bae06bdf09de3e4bd2e5e478f

Summary

The fix for CVE-2026-8406 secured SentMail.php?modfunc=body and DownloadWindow.php, but left two adjacent messaging entry points without equivalent object-level authorization:

1. Modules.php?modname=messaging/SentMail.php&modfunc=trash
2. Modules.php?modname=messaging/Trash.php&modfunc=body

This leaves one cross-user write primitive and one cross-user read primitive in the same feature area.

Issue 1: Cross-User Sent-Mail Trash Action

modules/messaging/SentMail.php:37-48 updates msg_outbox by request-supplied MAIL_ID only. No ownership check is applied before:

• WHERE MAIL_ID IN($mail_id)
• UPDATE msg_outbox SET ISTRASH=...

The normal Sent Mail list is user-scoped and requires istrash is NULL:

• modules/messaging/SentMail.php:200-210

Impact:

• Cross-user modification of msg_outbox
• Removal of another user's sent message from the victim's normal Sent Mail view

PoC:

POST /Modules.php?modname=messaging/SentMail.php&modfunc=trash&delete_ok=1 HTTP/1.1
Host: <target>
Cookie: PHPSESSID=<attacker-session>
Content-Type: application/x-www-form-urlencoded

mail[123]=Y

Where 123 is a victim msg_outbox.MAIL_ID.

Supporting references:

• modules/messaging/SentMail.php:37-48
• functions/DeletePromptFnc.php:162-180
• install/OpensisSchemaMysqlInc.sql:1339-1354

Issue 2: Cross-User Inbox Read via Trash Body View

modules/messaging/Trash.php:80-84 reads msg_inbox by attacker-controlled mail_id only:

• select mail_body,to_user,from_user,mail_datetime,mail_attachment from msg_inbox where mail_id='$mail_id'

The returned row is rendered immediately:

• modules/messaging/Trash.php:85-148

No check binds the target row to the current user or the current user's trash membership. The regular inbox body path does apply a current-user ownership check:

• modules/messaging/Inbox.php:441-447

Impact:

• Cross-user read of msg_inbox
• Disclosure of another user's message body and metadata

PoC:

GET /Modules.php?modname=messaging/Trash.php&modfunc=body&mail_id=57 HTTP/1.1
Host: <target>
Cookie: PHPSESSID=<attacker-session>

Where 57 is a victim msg_inbox.mail_id.

Supporting references:

• modules/messaging/Trash.php:80-84
• modules/messaging/Trash.php:85-148
• modules/messaging/Trash.php:273-274
• install/OpensisSchemaMysqlInc.sql:1310-1329

Why This Is Residual

The original fix added authorization to:

• modules/messaging/SentMail.php:74-76
• DownloadWindow.php:71-86

It did not add equivalent authorization to:

• modules/messaging/SentMail.php:37-48
• modules/messaging/Trash.php:80-84

Reachability

Messaging is reachable to non-admin roles through menu inclusion and profile_exceptions.CAN_USE='Y':

• modules/messaging/Menu.php:29-62
• Menu.php:32-66
• Modules.php:933-999
• Ajax.php:234-258
• install/SqlSampleDataInc.php:895-913

The vulnerable handlers do not perform an AllowEdit() check before acting:

• functions/AllowEditFnc.php:132-163