Read the docs
TI-2026-76794 Aliases CVE-2026-112784GHSA-pxhw-9vc5-hmj2

Missing authorization in OpenCATS email test endpoint lets users send mail

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

OpenCATS before 0.10.0 lacks an authorization check in ajax/testEmailSettings.php. Any authenticated user, including read-level users, can send the test message through the configured SMTP relay to any recipient with a spoofed From address (CWE-862).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed OpenCATS (opencats): 0.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencatsOpenCATSbefore 0.10.00.10.0Patch availableCNA
  • OpenCATS Vendoropencats Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA

Remediation

Upgrade OpenCATS to version 0.10.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA OpenCATS (opencats) Fixed in 0.10.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenCATS 0.10.0

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-76798 Missing authorization in OpenCATS calendar edit and deletePriority LOW 24
    • TI-2026-76797 Missing authorization in OpenCATS EEO reports exposes demographic dataPriority LOW 24
    • TI-2026-76796 Missing authorization in OpenCATS import revert action lets users delete recordsPriority LOW 24
    Show all 6 records →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112784
  2. 2026-10-20 Alias added: GHSA-pxhw-9vc5-hmj2
  3. 2026-10-20 CISA SSVC decision points changed

References

Patch 1

Other 3

  • TI-2021-22549 OpenCATS 0.9.4 Remote Code Execution via Resume Upload CVSS 4.0CRITICAL 9.3
  • TI-2026-22120 OpenCATS PHP Code Injection via installer AJAX endpoint CVSS 4.0CRITICAL 9.2
  • TI-2026-36639 OpenCATS - SQL Injection in DataGrid sortDirection Parameter CVSS 4.0HIGH 8.4
  • TI-2023-12031 Cross-site scripting in OpenCATS CVSS 3.1MEDIUM 6.1
  • TI-2023-12032 Cross-site scripting in OpenCATS CVSS 3.1MEDIUM 5.4
  • TI-2023-12030 Open redirect in OpenCATS CVSS 3.1MEDIUM 5.4
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences