CVE-2026-45776

Vulnerability

A flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. This vulnerability affects all deployments of Open XDMoD prior to version 11.0.3 that include the optional Job Performance (SUPReMM) module [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTPS POST request to the affected Open XDMoD installation. This request manipulates a session variable that influences authorization decisions, potentially bypassing intended data access restrictions. No specific authentication or network position requirements are detailed, but the attack targets the access control logic [1].

Impact

If an installation includes the optional Job Performance (SUPReMM) module, a successful exploit allows an attacker to bypass intended data access restrictions and view other users' compute job efficiency metrics. The scope of the compromise is limited to unauthorized access to sensitive job performance data [1].

Mitigation

The vulnerability was patched in Open XDMoD version 11.0.3, released on 2026-05-12 [2]. As a workaround, users can manually apply a provided patch file before upgrading. Instructions for applying the patch are available in the references [1].