{"id":"CVE-2026-112783","kind":"vulnerability","aliases":["CVE-2026-112783"],"related":[],"title":"OpenCATS: read-only users can edit and delete activity records","description":"OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.","summary":"OpenCATS versions before 0.10.0 fail to check authorization in the activity delete and edit AJAX endpoints. An logged-in user with read-only access can change or delete activity and pipeline history for candidates, contacts and companies.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["opencats","package","php","self-hosted"],"not_affected_if":["no-read-only-users","version-0.10.0-or-later"],"how_to_check":"- Check the installed OpenCATS version and see whether it is below `0.10.0`.\n- Confirm that `ajax/deleteActivity.php` and `ajax/editActivity.php` are present in the install.","fix":"- Upgrade OpenCATS to `0.10.0` or later.","status":"open","published_at":"2026-10-20T11:17:18+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:52+00:00","updated_at":"2026-10-25T04:24:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:24:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenCATS to `0.10.0` or later.","reach":"network","title":"OpenCATS: read-only users can edit and delete activity records","impact":"medium","summary":"OpenCATS versions before 0.10.0 fail to check authorization in the activity delete and edit AJAX endpoints. An logged-in user with read-only access can change or delete activity and pipeline history for candidates, contacts and companies.","category":"package","nicknames":[],"who_cares":["opencats","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Read-only users can alter or delete candidate and company activity history","analyst_note":"","how_to_check":"- Check the installed OpenCATS version and see whether it is below `0.10.0`.\n- Confirm that `ajax/deleteActivity.php` and `ajax/editActivity.php` are present in the install.","needs_analyst":false,"not_affected_if":["version-0.10.0-or-later","no-read-only-users"],"who_is_affected":"Teams that self-host OpenCATS before 0.10.0 and have users with read-level access, such as recruiters or external viewers, are exposed. Instances already on 0.10.0 or later are not affected by this flaw, and installs with no read-only accounts face much less risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000576,"input_tokens":3344,"output_tokens":484,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112783':14A,17A '-2026':13A,16A '0.10.0':27B,65C 'access':49B 'activ':10A,34B,54B,85C,102C 'activityid':93C 'ajax':38B 'ajax/deleteactivity.php':72C 'ajax/editactivity.php':74C 'allow':76C 'arbitrari':92C 'attack':88C 'authent':87C 'author':31B,69C 'candid':59B,107C 'chang':51B 'check':30B 'compani':62B,110C 'contact':60B,108C 'contain':66C 'cve':12A,15A 'delet':9A,35B,53B,84C,101C 'edit':7A,37B,82C 'endpoint':39B 'entri':86C 'fail':28B 'get':95C 'histori':57B,105C 'host':23B 'level':79C 'log':42B 'logged-in':41B 'miss':68C 'modifi':99C 'opencat':1A,18B,24B,63C 'packag':19B 'php':20B 'pipelin':56B,104C 'post':97C 'read':3A,47B,78C 'read-level':77C 'read-on':2A,46B 'record':11A 'self':22B 'self-host':21B 'suppli':90C 'user':5A,44B,80C 'version':25B 'via':94C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host OpenCATS before 0.10.0 and have users with read-level access, such as recruiters or external viewers, are exposed. Instances already on 0.10.0 or later are not affected by this flaw, and installs with no read-only accounts face much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112783","severity":null,"published_at":"2026-10-20T11:17:18+00:00","modified_at":"2026-10-22T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}