CVE-2026-76177 Details
Description
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in OCS Inventory NG version 2.12.4, specifically within the Ocsreports module. The vulnerability arises in the /ocsreports/?function=tele_activate endpoint, where there is inadequate validation of the HTTPS_SERV and FILE_SERV parameters. This flaw allows an authenticated user with operator privileges to inject arbitrary values into these parameters. Consequently, the OCS Inventory server may be tricked into making HTTP or HTTPS requests to external systems or internal resources. Such behavior could potentially expose internal network services or metadata from cloud service resources.
Users can upgrade to OCS Inventory NG version 2.12.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OCS Inventory NG Ocsreports | 2.12.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |