OpenCATS Missing Authorization Leading to Data Rollback

Executive Summary

OpenCATS before 0.10.0 has a missing authorization flaw in ImportUI::handleRequest() that lets low-privileged users with READ access trigger a mass deletion of imported candidate, company, and contact records by using the import module's revert action with an importID.

Useful 0 Not Useful 0

Detection Guidance

Check OpenCATS version with: grep -r "version" /path/to/opencats/config.php. If version is below 0.10.0, the system is vulnerable. Review import logs in /path/to/opencats/logs/ for unexpected revert actions or mass deletions.

Useful 0 Not Useful 0

Impact Analysis

Attackers with minimal access could delete large amounts of critical recruitment data, disrupting hiring processes and causing data loss for organizations using vulnerable OpenCATS versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged users to mass-delete sensitive candidate, company, and contact records, which could lead to unauthorized data destruction. Such unauthorized deletion or modification of personal data may violate GDPR's data integrity and availability principles, potentially resulting in non-compliance with Article 5 (principles relating to processing of personal data) and Article 32 (security of processing). For HIPAA, if the system handles protected health information (PHI), unauthorized deletion could breach the Security Rule's integrity and availability requirements under 45 CFR § 164.312.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenCATS to version 0.10.0 or later immediately. Restrict READ-level user permissions to prevent exploit attempts. Monitor import logs for suspicious revert actions and review database backups for unauthorized deletions.

Useful 0 Not Useful 0