Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-112784OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php

Medium 4.3

In plain English

A medium-severity missing authorization in OpenCATS from opencats. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.

Affected products (as reported)

Vendor	Product	Versions
opencats	OpenCATS	0 – before 0.10.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/opencats/OpenCATS/issues/720 issue-tracking
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd patch
OpenCATS v0.10.0 Release Notes release-notes
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/testEmailSettings.php technical-description
VulnCheck Advisory: OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php third-party-advisory