CVE-2026-32867 is a medium severity flaw in OPEXUS eComplaint, scored CVSS 5.4. An unauthenticated person who obtains or guesses a case number can upload arbitrary files to that case through a public page. Upgrade to version 10.1.0.0 or later. Nothing in the record suggests data theft.
What's affected
The NVD record says OPEXUS eComplaint before version 10.1.0.0 is affected. The upload page is Portal/EEOC/DocumentUploadPub.aspx. The record points to the CISA CSAF advisory VA-26-077-01, which I could not load.
The record says users would see unexpected files in cases, and that uploading many files could use up storage.
How to check if you're exposed
Check your eComplaint version against 10.1.0.0.
Then look at recent uploads on the public portal. Files with odd names, unusual types or from times when staff were offline are worth a look.
Check disk usage on the storage that holds case documents for sudden growth.
What to do now
- Upgrade eComplaint to 10.1.0.0 or later.
- Review recently uploaded documents in cases and remove any you cannot explain.
- Add file type and size limits at your reverse proxy while you plan the upgrade.
- Monitor storage use for the document folder.
- Check the CISA advisory VA-26-077-01 for the vendor's own guidance.
Why it matters
The weaknesses are CWE-425, direct request, where a page can be reached without the checks it should have, and CWE-639, authorization bypass through a user controlled key. The key here is the case number, which acts like a password in the upload flow but is a guessable identifier.
The effect is limited to unwanted files and storage use, which fits the medium score. In a case system, though, unexpected documents in a legal matter can cost staff time and raise trust questions. The record's KEV flag is false.
Quick check
Is data exposed by this flaw?
The record describes uploads and storage use, not data disclosure. A sister flaw in the same release, CVE-2026-32865, concerns password reset.
Sources
Last reviewed: 19 October 2026.
