CVE-2026-112783mediumCWE-862

CVE-2026-112783: medium-severity vulnerability in OpenCATS

OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints

Published · Updated

Follow this CVE+ Monitor OpenCATS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
opencats · OpenCATS
Related CVEs — OpenCATS

In the same product, most dangerous first.

CVE-2026-27760CRITICALOpenCATS PHP Code Injection via installer AJAX endpointEPSS 33.0%CVE-2026-54453HIGHOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)EPSS 0.4%CVE-2026-54454CRITICALOpenCATS: Authenticated RCE in the Import moduleEPSS 0.4%CVE-2026-115513MEDIUMOpenCATS before 0.12.0 Stored XSS via MRU Navigation PanelEPSS 0.3%CVE-2026-112787MEDIUMOpenCATS before 0.10.0 Missing Authorization in Reports Module EEO ReportsEPSS 0.3%CVE-2026-112786MEDIUMOpenCATS before 0.10.0 Missing Authorization via Import Revert ActionEPSS 0.3%