OpenCATS Missing Authorization in Activity Management

Executive Summary

OpenCATS before version 0.10.0 has a missing authorization vulnerability in the AJAX endpoints ajax/deleteActivity.php and ajax/editActivity.php. This flaw allows users with READ-level access to edit or delete activity entries. Attackers who are authenticated can manipulate or remove activity and pipeline history for candidates, contacts, and companies by supplying an arbitrary activityID via GET or POST requests.

Useful 0 Not Useful 0

Detection Guidance

Check OpenCATS version with 'grep -r "version" /path/to/opencats/ | grep -i version'. If version is below 0.10.0, the system is vulnerable. Inspect network traffic for unauthorized POST/GET requests to /ajax/editActivity.php or /ajax/deleteActivity.php with arbitrary activityID parameters.

Useful 0 Not Useful 0

Impact Analysis

Authenticated attackers with READ-level access can modify or delete activity entries and pipeline history for candidates, contacts, and companies. This could lead to data tampering, loss of critical records, or unauthorized changes to hiring pipelines.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity and accountability requirements in GDPR and HIPAA. It may result in non-compliance with data protection and audit trail standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenCATS to version 0.10.0 or later immediately. Review and restrict user access levels to ensure only authorized users can edit or delete activities. Monitor activity logs for suspicious modifications or deletions.

Useful 0 Not Useful 0