CVE-2026-112784 in OpenCATS
Summary
by MITRE • 10/20/2026
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The identified security flaw resides within OpenCATS versions prior to 0.10.0, specifically targeting the ajax/testEmailSettings.php endpoint. This vulnerability is classified as a missing authorization issue, which fundamentally represents an access control failure where the application fails to enforce proper restrictions on authenticated users regarding specific actions or data. In this context, while authentication successfully verifies that a user has logged into the system, it does not validate whether that user possesses the necessary privileges to execute email configuration tests. This gap in logic allows any authenticated account, regardless of its assigned role level, to interact with functionality intended for administrative use only.
The technical mechanism of exploitation involves an attacker supplying specific parameters such as testEmailAddress and fromAddress within a request directed at the vulnerable endpoint. Because the server does not adequately check if the requesting user has permission to modify or utilize SMTP relay settings, it proceeds to process these inputs. The application then utilizes its configured Simple Mail Transfer Protocol (SMTP) relay infrastructure to dispatch an email message. Crucially, this action is performed without requiring administrative credentials or additional verification steps that would typically be mandated for such sensitive operations involving external communication channels and identity spoofing capabilities.
The operational impact of this vulnerability extends beyond simple spam generation due to the ability to manipulate sender information. An attacker with even read-level access can craft messages where the fromAddress parameter is set to an arbitrary value, effectively allowing them to spoof the sender's identity. This capability facilitates phishing attacks or social engineering campaigns that appear legitimate because they originate from a trusted domain managed by the organization. Furthermore, the abuse of the SMTP relay contributes to resource exhaustion and potential blacklisting of the organization's mail server IP addresses if large volumes of unsolicited messages are sent, thereby damaging organizational reputation and email deliverability for legitimate communications.
From an industry standard perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Control or Authorization Bypass through User Role Manipulation. The failure to restrict access based on user roles is a classic example of broken access control logic. Additionally, the ability to send spoofed emails using organizational infrastructure can be mapped to MITRE ATT&CK techniques related to Initial Access and Defense Evasion, specifically those involving email-based attacks where trust in internal systems is exploited to bypass security controls or deceive recipients.
To mitigate this vulnerability, it is imperative that developers implement strict role-based access control checks on the ajax/testEmailSettings.php endpoint before processing any requests. Only users with explicit administrative privileges should be permitted to execute tests of SMTP settings or send configuration verification emails. Input validation must also be enforced to ensure that parameters like testEmailAddress and fromAddress are sanitized and restricted to expected formats, although this is secondary to fixing the authorization logic. Upgrading OpenCATS to version 0.10.0 or later resolves this issue as it includes patches for these access control deficiencies. Until an upgrade can be performed, temporary mitigations such as restricting direct web access to the ajax directory via firewall rules or implementing additional authentication layers at the reverse proxy level may reduce exposure while maintaining operational continuity.