OpenCode Systems OC Messaging USSD Gateway Broken Access Control Vulnerability Allowing Unauthorized SMS Access

A broken access control vulnerability has been identified in OpenCode Systems OC Messaging / USSD Gateway version 6.32.2. This vulnerability allows authenticated low-privileged attackers to access arbitrary SMS messages by manipulating a company or tenant identifier parameter in HTTP requests. The issue arises in the web-based control panel, leading to unauthorized access to sensitive authentication data, including one-time passwords (OTP) used for account recovery and login verification in a multi-tenant environment.

Impact

Exploitation of this vulnerability allows cross-tenant access to SMS and OTP messages, potentially leading to account compromise and unauthorized access in a multi-tenant environment.