Live › vulnerability › CVE-2026-112787
Go to dashboardOpenCATS before 0.10.0 skips the canSeeEEOInfo permission check in ReportsUI::handleRequest(). A logged-in user can call the customizeEEOReport and generateEEOReportPreview actions to read aggregate ethnicity, veteran, gender and disability statistics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams self-hosting OpenCATS before 0.10.0 where any authenticated user account exists beyond those meant to see EEO data. Exposure depends on having a login, so instances with only trusted admin accounts carry less risk. Hosted or upgraded installs on 0.10.0 or later are not affected.
No product ranges from the sources yet.
0.10.0.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
This page as .md · .json · in your agent: get_signal("CVE-2026-112787")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.