CVE-2026-112787mediumCWE-862

CVE-2026-112787: falha de média gravidade em OpenCATS

OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports

Publicada em

Seguir esta CVE+ Monitorar OpenCATS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
opencats · OpenCATS
CVEs relacionadas — OpenCATS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27760CRITICALOpenCATS PHP Code Injection via installer AJAX endpointEPSS 33.0%CVE-2026-54453HIGHOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)EPSS 0.4%CVE-2026-54454CRITICALOpenCATS: Authenticated RCE in the Import moduleEPSS 0.4%CVE-2026-115513MEDIUMOpenCATS before 0.12.0 Stored XSS via MRU Navigation PanelEPSS 0.3%CVE-2026-112786MEDIUMOpenCATS before 0.10.0 Missing Authorization via Import Revert ActionEPSS 0.3%CVE-2026-112785MEDIUMOpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX EndpointsEPSS 0.3%