Missing Authorization in OpenCATS Reports Module Affects User Data Access
CVE-2026-112787

5.3MEDIUM

Key Information:

Vendor

Opencats

Status
Opencats
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112787?

OpenCATS versions prior to 0.10.0 are susceptible to a missing authorization vulnerability within the ReportsUI module. This flaw permits authenticated users to access EEO demographic reports without the requisite permission (canSeeEEOInfo). Consequently, attackers may use functions such as customizeEEOReport and generateEEOReportPreview to retrieve collective demographic data, including ethnicity, veteran status, gender, and disability statistics, exposing sensitive information that should remain restricted.

Affected Version(s)

OpenCATS 0 < 0.10.0

References

https://github.com/opencats/OpenCATS/issues/720
issue-tracking
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f...
patch
https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.