CVE-2026-112786 in OpenCATS
Summary
by MITRE • 10/20/2026
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in OpenCATS prior to version 0.10.0 represents a critical failure in server-side access control mechanisms within the ImportUI::handleRequest() function. This flaw allows authenticated users with low-privileged READ-level access to execute administrative actions that should be restricted to higher-privilege roles, specifically by triggering data import rollbacks. The core technical issue stems from an insufficient verification of user permissions before processing requests intended to revert or delete imported records. In a properly secured application architecture, the system must validate not only that a user is authenticated but also that they possess the specific authorization rights required for the action being requested. Here, the absence of such checks means that any logged-in user can manipulate the import module's state without restriction, bypassing intended role-based access controls entirely.
From an operational perspective, this vulnerability enables attackers to perform mass deletion operations on critical business data including candidate profiles, company information, and contact details. By supplying a valid importID in their request, malicious actors or compromised accounts with minimal privileges can trigger the revert action, effectively erasing large volumes of imported records. This capability transforms what might seem like a minor administrative feature into a significant vector for data destruction. The impact extends beyond simple data loss; it compromises the integrity and availability of the applicant tracking system's database. Organizations relying on OpenCATS for recruitment workflows may face severe disruptions in their hiring processes, requiring extensive manual reconstruction of lost records or restoration from backups, which introduces downtime and potential data inconsistency issues during recovery efforts.
This vulnerability aligns with CWE-269, Improper Privilege Control, as it involves a user exploiting elevated functionality without proper authorization. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to Defense Evasion or Impact, specifically where an adversary manipulates system state through unauthorized API calls or interface interactions. The ability of low-privileged users to execute high-impact destructive actions highlights a fundamental gap in the application's security model regarding input validation and permission enforcement at the business logic layer rather than just network or authentication layers.
To mitigate this vulnerability, organizations running versions of OpenCATS prior to 0.10.0 should immediately upgrade to version 0.10.0 or later where these access control checks have been implemented. For environments unable to patch immediately due to compatibility constraints, implementing a web application firewall rule that restricts access to the import revert endpoint based on user role headers can provide temporary protection. Additionally, administrators should audit existing user accounts to ensure that READ-level permissions are strictly limited and do not inadvertently grant broader system interaction capabilities. Regular security assessments focusing on broken object level authorization flaws are recommended to identify similar gaps in other modules of the application before they can be exploited for data destruction or further compromise.