---
id: "CVE-2026-112785"
kind: "vulnerability"
aliases: ["CVE-2026-112785"]
title: "OpenCATS: read-only users can alter or delete any saved list"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["opencats", "package", "php", "self-hosted"]
not_affected_if: ["no-read-level-users", "opencats-0.10.0-or-later"]
published_at: "2026-10-20T11:17:18+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112785", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# OpenCATS: read-only users can alter or delete any saved list

OpenCATS before 0.10.0 lets users with READ-level access create, rename, delete and populate saved lists through AJAX endpoints that skip authorization checks. An authenticated attacker can change or delete any saved list across the whole site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenCATS version, for example in the application's version file or admin page, and compare it with `0.10.0`
- Review user roles for accounts that hold READ-level access only

## Fix

- Upgrade OpenCATS to `0.10.0` or later
- Until upgraded, restrict access to the saved-list endpoints (newList.php, editListName.php, deleteList.php, addToLists.php) to trusted users

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112785

## From the sources

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_