Live › vulnerability › CVE-2026-112785
Go to dashboardOpenCATS before 0.10.0 lets users with READ-level access create, rename, delete and populate saved lists through AJAX endpoints that skip authorization checks. An authenticated attacker can change or delete any saved list across the whole site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host OpenCATS before 0.10.0 and have users with read-only accounts are exposed, because those accounts can reach the saved-list endpoints. Instances already on 0.10.0 or later, or with no low-privilege users, can skip it.
No product ranges from the sources yet.
0.10.00.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.
This page as .md · .json · in your agent: get_signal("CVE-2026-112785")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.