CVE-2026-112785mediumCWE-862

CVE-2026-112785: falha de média gravidade em OpenCATS

OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints

Publicada em

Seguir esta CVE+ Monitorar OpenCATS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
opencats · OpenCATS
CVEs relacionadas — OpenCATS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27760CRITICALOpenCATS PHP Code Injection via installer AJAX endpointEPSS 33.0%CVE-2026-54453HIGHOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)EPSS 0.4%CVE-2026-54454CRITICALOpenCATS: Authenticated RCE in the Import moduleEPSS 0.4%CVE-2026-115513MEDIUMOpenCATS before 0.12.0 Stored XSS via MRU Navigation PanelEPSS 0.3%CVE-2026-112787MEDIUMOpenCATS before 0.10.0 Missing Authorization in Reports Module EEO ReportsEPSS 0.3%CVE-2026-112786MEDIUMOpenCATS before 0.10.0 Missing Authorization via Import Revert ActionEPSS 0.3%