CVE-2026-76176

OCS Inventory's web console (OCSReports) contains a SQL injection flaw (CWE-89) in the admin_double function of /ocsreports/index.php. An authenticated user with operator privileges can submit crafted values in the ID field of the selected_grp_dupli[] parameter, causing improperly validated input to be incorporated into the SQL queries the application executes. Successful exploitation allows the attacker to retrieve information stored in the application's database. Any organization running an affected OCS Inventory deployment where users hold operator-level accounts is exposed, particularly if the console is reachable from untrusted networks. Exploitation has not been observed: there is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS assigns only a ~0.3% probability of exploitation within 30 days.

What to do: Because no fixed version is stated in the available data, check the OCS Inventory project and its CNA (INCIBE) advisories for a patched release and upgrade as soon as one is available. In the interim, restrict access to /ocsreports/index.php (especially the admin_double function) to trusted administrators, audit operator-level accounts, and remove or downgrade unnecessary operator privileges. Review web/application logs for anomalous requests containing selected_grp_dupli[] parameters as a check for attempted exploitation.