Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: OpenCATS 0.10.0 Clear all filters
TI-2026-76798 CVE-2026-113349 · GHSA-5q4v-58r2-wwvg

Missing authorization in OpenCATS calendar edit and delete

Priority LOW 24

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00261 Published 2026-10-20 Fixed in 0.10.0 CWE-639
TI-2026-76797 CVE-2026-112787 · GHSA-hfjp-88cg-xwf4

Missing authorization in OpenCATS EEO reports exposes demographic data

Priority LOW 24

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00287 Published 2026-10-20 Fixed in 0.10.0 CWE-862
TI-2026-76795 CVE-2026-112785 · GHSA-q7v9-9q5g-w293

Missing authorization in OpenCATS saved-list AJAX endpoints

Priority LOW 24

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00267 Published 2026-10-20 Fixed in 0.10.0 CWE-862
TI-2026-76794 CVE-2026-112784 · GHSA-pxhw-9vc5-hmj2

Missing authorization in OpenCATS email test endpoint lets users send mail

Priority LOW 24

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00245 Published 2026-10-20 Fixed in 0.10.0 CWE-862
TI-2026-76793 CVE-2026-112783 · GHSA-2rp2-4gqx-g5jr

OpenCATS AJAX endpoints let read users edit and delete activity

Priority LOW 24

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00255 Published 2026-10-20 Fixed in 0.10.0 CWE-862