Live › vulnerability › CVE-2026-112786
Go to dashboardOpenCATS before 0.10.0 does not check authorization in the import handler, so a user with read-only access can call the import revert action. That lets them mass-delete imported candidate, company and contact records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host OpenCATS before 0.10.0 and have users with READ-level access, since those accounts can trigger the revert. Instances already on 0.10.0 or later, or with no read-only or low-privileged accounts, are less exposed.
No product ranges from the sources yet.
0.10.00.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.
This page as .md · .json · in your agent: get_signal("CVE-2026-112786")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.