---
id: "CVE-2026-112783"
kind: "vulnerability"
aliases: ["CVE-2026-112783"]
title: "OpenCATS: read-only users can edit and delete activity records"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["opencats", "package", "php", "self-hosted"]
not_affected_if: ["no-read-only-users", "version-0.10.0-or-later"]
published_at: "2026-10-20T11:17:18+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112783", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# OpenCATS: read-only users can edit and delete activity records

OpenCATS versions before 0.10.0 fail to check authorization in the activity delete and edit AJAX endpoints. An logged-in user with read-only access can change or delete activity and pipeline history for candidates, contacts and companies.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenCATS version and see whether it is below `0.10.0`.
- Confirm that `ajax/deleteActivity.php` and `ajax/editActivity.php` are present in the install.

## Fix

- Upgrade OpenCATS to `0.10.0` or later.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112783

## From the sources

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_