CVE-2026-112785 in OpenCATS
Summary
by MITRE • 10/20/2026
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in OpenCATS versions prior to 0.10.0 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw allows authenticated users with READ-level permissions to perform administrative or write operations that are strictly outside the scope of their assigned privileges. The core technical issue lies within several AJAX endpoints including newList.php, editListName.php, deleteList.php, and addToLists.php. These scripts fail to adequately verify whether the requesting user possesses the necessary authority to execute actions such as creating new saved lists, modifying existing list names, deleting lists owned by other users, or adding candidates to arbitrary lists. Consequently, any authenticated account with even minimal read access can manipulate data structures that should be restricted to administrators or higher-privileged roles.
From an operational perspective, this vulnerability enables a wide range of malicious activities for attackers who have obtained valid credentials through phishing, credential stuffing, or other means. An attacker could delete critical saved lists used by recruiters or hiring managers, leading to significant disruption in workflow and potential loss of organized candidate data if backups are not maintained. Furthermore, the ability to create new lists allows an attacker to obfuscate their activities or set up traps for unsuspecting users. The capability to rename existing lists can cause confusion regarding which candidates belong to which recruitment pipeline, potentially leading to compliance issues with labor laws or internal policies that require accurate tracking of candidate interactions. Additionally, populating saved lists with arbitrary data could be used to spam recipients if the system integrates with email notification features, thereby degrading service quality and trust in the platform.
This type of vulnerability aligns closely with MITRE ATT&CK technique T1078, Valid Accounts, as it relies on legitimate credentials being abused due to insufficient privilege separation. It also reflects aspects of T1496, Resource Hijacking, if the attacker uses the system resources to store excessive data or disrupt operations. The lack of proper authorization checks means that the principle of least privilege is completely bypassed, allowing low-privilege users to escalate their effective permissions without needing a separate vulnerability for elevation. This underscores a fundamental design flaw in how session states and user roles are validated against specific API endpoints within the application logic.
To mitigate this risk, organizations running OpenCATS must upgrade immediately to version 0.10.0 or later where these authorization checks have been implemented correctly. For environments that cannot be patched instantly due to operational constraints, temporary mitigations should include restricting access to the affected AJAX endpoints via web server configuration if possible, such as using IP whitelisting for administrative functions or implementing a Web Application Firewall rule set to block requests containing specific parameters associated with list manipulation by non-admin users. Additionally, enforcing strict role-based access control policies and auditing user permissions regularly can help identify accounts that have been granted excessive privileges inadvertently. Regular security assessments focusing on broken object level authorization are essential to prevent similar vulnerabilities in custom or legacy web applications.