{"id":"CVE-2026-112785","kind":"vulnerability","aliases":["CVE-2026-112785"],"related":[],"title":"OpenCATS: read-only users can alter or delete any saved list","description":"OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.","summary":"OpenCATS before 0.10.0 lets users with READ-level access create, rename, delete and populate saved lists through AJAX endpoints that skip authorization checks. An authenticated attacker can change or delete any saved list across the whole site.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["opencats","package","php","self-hosted"],"not_affected_if":["no-read-level-users","opencats-0.10.0-or-later"],"how_to_check":"- Check the installed OpenCATS version, for example in the application's version file or admin page, and compare it with `0.10.0`\n- Review user roles for accounts that hold READ-level access only","fix":"- Upgrade OpenCATS to `0.10.0` or later\n- Until upgraded, restrict access to the saved-list endpoints (newList.php, editListName.php, deleteList.php, addToLists.php) to trusted users","status":"open","published_at":"2026-10-20T11:17:18+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:50+00:00","updated_at":"2026-10-25T04:24:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:24:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenCATS to `0.10.0` or later\n- Until upgraded, restrict access to the saved-list endpoints (newList.php, editListName.php, deleteList.php, addToLists.php) to trusted users","reach":"internet","title":"OpenCATS: read-only users can alter or delete any saved list","impact":"medium","summary":"OpenCATS before 0.10.0 lets users with READ-level access create, rename, delete and populate saved lists through AJAX endpoints that skip authorization checks. An authenticated attacker can change or delete any saved list across the whole site.","category":"package","nicknames":[],"who_cares":["opencats","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Any saved list in the site can be renamed, emptied or deleted by a read-only user.","analyst_note":"","how_to_check":"- Check the installed OpenCATS version, for example in the application's version file or admin page, and compare it with `0.10.0`\n- Review user roles for accounts that hold READ-level access only","needs_analyst":false,"not_affected_if":["opencats-0.10.0-or-later","no-read-level-users"],"who_is_affected":"Teams that self-host OpenCATS before 0.10.0 and have users with read-only accounts are exposed, because those accounts can reach the saved-list endpoints. Instances already on 0.10.0 or later, or with no low-privilege users, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3339,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112785':15A,18A '-2026':14A,17A '0.10.0':27B,65C 'access':34B 'across':59B 'addtolists.php':98C 'ajax':43B,86C 'allow':72C 'alter':7A,103C 'attack':51B,89C 'authent':50B,88C 'author':47B,69C 'chang':53B 'check':48B 'contain':66C 'creat':35B,78C 'cve':13A,16A 'delet':9A,37B,55B,80C,105C 'deletelist.php':96C 'editlistname.php':95C 'endpoint':44B,87C 'host':24B 'let':28B 'level':33B,75C 'list':12A,41B,58B,84C,108C 'miss':68C 'newlist.php':94C 'opencat':1A,19B,25B,63C 'packag':20B 'php':21B 'popul':39B,82C 'read':3A,32B,74C 'read-level':31B,73C 'read-on':2A 'renam':36B,79C 'request':92C 'save':11A,40B,57B,83C,107C 'savedlistid':101C 'self':23B 'self-host':22B 'send':91C 'site':62B,110C 'site-wid':109C 'skip':46B 'user':5A,29B,76C 'via':85C 'vulner':70C 'whole':61B 'wide':111C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host OpenCATS before 0.10.0 and have users with read-only accounts are exposed, because those accounts can reach the saved-list endpoints. Instances already on 0.10.0 or later, or with no low-privilege users, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112785","severity":null,"published_at":"2026-10-20T11:17:18+00:00","modified_at":"2026-10-20T17:17:31+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}