Live › vulnerability › CVE-2026-112783
Go to dashboardOpenCATS versions before 0.10.0 fail to check authorization in the activity delete and edit AJAX endpoints. An logged-in user with read-only access can change or delete activity and pipeline history for candidates, contacts and companies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host OpenCATS before 0.10.0 and have users with read-level access, such as recruiters or external viewers, are exposed. Instances already on 0.10.0 or later are not affected by this flaw, and installs with no read-only accounts face much less risk.
No product ranges from the sources yet.
0.10.0.ajax/deleteActivity.php and ajax/editActivity.php are present in the install.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
This page as .md · .json · in your agent: get_signal("CVE-2026-112783")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.