---
id: "CVE-2026-115513"
kind: "vulnerability"
aliases: ["CVE-2026-115513"]
title: "OpenCATS: stored script injection via record names hijacks admin sessions"
severity: "high"
cvss: 8.7
epss: 0.00236
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["opencats", "package", "php", "self-hosted"]
not_affected_if: ["already-on-0.12.0-or-later"]
published_at: "2026-10-22T17:16:59+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115513", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115513", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OpenCATS: stored script injection via record names hijacks admin sessions

OpenCATS stores candidate, company, contact, job order and list names without escaping them, then renders them unescaped in the Recent navigation panel. A low-privileged user can plant JavaScript that runs in an administrator's browser, which can steal cookies and take full admin control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed OpenCATS version; affected versions are those before 0.12.0.

## Fix

Upgrade OpenCATS to 0.12.0 or later.
After upgrading, review recently created or renamed records for script tags or event handlers in their names.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115513
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115513

## From the sources

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_