CVEvulnerability
CVE-2026-112783
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-10-20
- Last modified
- 2026-10-22
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-862
Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/deleteActivity.php github.com
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/editActivity.php github.com
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd github.com
- https://github.com/opencats/OpenCATS/issues/720 github.com
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0 github.com
- https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-activity-ajax-endpoints www.vulncheck.com