[ CVE-2026-112783 · Published 20 Oct 2026 ]
Vulnerability in OpenCATS
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/deleteA…
- github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/editAct…
- github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- github.com/opencats/OpenCATS/issues/720
- github.com/opencats/OpenCATS/releases/tag/v0.10.0
- www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-activity-…