CVE-2026-112785
Deferred Deferred - Pending Action

OpenCATS Missing Authorization in Saved Lists

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-112785
EUVD
EUVD-2026-104917

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opencats OpenCATS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenCATS before 0.10.0 has a missing authorization vulnerability in its Saved-List AJAX endpoints. Authenticated users with READ-level access can create, rename, delete, and populate saved lists across the entire system by exploiting endpoints like newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID.

Detection Guidance

Check for unauthorized modifications to saved lists in OpenCATS by monitoring AJAX requests to endpoints like newList.php, editListName.php, deleteList.php, and addToLists.php. Look for requests with READ-level user access performing actions outside their permissions.

Impact Analysis

An attacker with READ access could modify or delete any saved list on the system, disrupting data organization or causing data loss. They could also add unauthorized items to lists, potentially corrupting stored information or bypassing intended access controls.

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, violating integrity and access control requirements in GDPR and HIPAA. It may result in non-compliance due to potential exposure of sensitive data or inability to maintain accurate records.

Mitigation Strategies

Upgrade OpenCATS to version 0.10.0 or later to address the missing authorization flaw. If upgrading is not immediately possible, restrict access to the vulnerable AJAX endpoints and implement strict input validation for savedListID parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...