CVE-2026-112783
MEDIUM
CVSS 4.3
Published: 2026-10-20
Modified: 2026-10-20
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
Quick Facts
| CVE ID | CVE-2026-112783 |
| CVSS Score | 4.3 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| Published | 2026-10-20 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7…
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7…
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f501…
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
- https://www.vulncheck.com/advisories/opencats-before-0.10.0-…