Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-112786OpenCATS before 0.10.0 Missing Authorization via Import Revert Action

Medium 5.4

In plain English

A medium-severity missing authorization in OpenCATS from opencats. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.

Affected products (as reported)

Vendor	Product	Versions
opencats	OpenCATS	0 – before 0.10.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/opencats/OpenCATS/issues/720 issue-tracking
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd patch
OpenCATS v0.10.0 Release Notes release-notes
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/import/ImportUI.php#L155-L188 technical-description
VulnCheck Advisory: OpenCATS before 0.10.0 Missing Authorization via Import Revert Action third-party-advisory