Live › vulnerability › CVE-2026-112784
Go to dashboardOpenCATS before 0.10.0 lacks an authorization check on ajax/testEmailSettings.php, so any authenticated user, including read-only accounts, can trigger a test email. The attacker chooses the recipient and From address, enabling spoofed mail sent through the configured SMTP relay.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host OpenCATS before 0.10.0 with an SMTP relay configured. Any user with an account, including read-level users, can reach the flawed endpoint, so the risk is about who holds accounts. Instances without a configured relay or on 0.10.0 or later are not affected.
No product ranges from the sources yet.
ajax/testEmailSettings.php in the OpenCATS install directory0.10.0; anything below is affected0.10.0 or laterajax/testEmailSettings.php at the web server levelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.
This page as .md · .json · in your agent: get_signal("CVE-2026-112784")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.