Missing Authorization in OpenCATS Allows Unauthorized Modification of Activity Entries
CVE-2026-112783

5.3MEDIUM

Key Information:

Vendor

Opencats

Status
Opencats
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112783?

OpenCATS prior to version 0.10.0 contains a missing authorization vulnerability in the AJAX endpoints used for activity management. This flaw enables READ-level users to modify or delete activity entries pertaining to candidates, contacts, and companies. By supplying an arbitrary activityID in GET or POST requests, authenticated attackers can manipulate activity records, potentially compromising the integrity of the system. It is crucial for users of affected versions to upgrade to mitigate these security concerns.

Affected Version(s)

OpenCATS 0 < 0.10.0

References

https://github.com/opencats/OpenCATS/issues/720
issue-tracking
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f...
patch
https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.