CVE-2026-112787
Deferred Deferred - Pending Action

OpenCATS Missing Authorization in EEO Reports

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-112787
EUVD
EUVD-2026-104919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opencats OpenCATS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in OpenCATS before version 0.10.0. It allows authenticated users to view EEO demographic reports without the required canSeeEEOInfo permission. Attackers can exploit the customizeEEOReport and generateEEOReportPreview actions to access aggregate statistics on ethnicity, veteran status, gender, and disability.

Detection Guidance

To detect this vulnerability, check OpenCATS version with: grep -r 'version' /path/to/opencats. If version is below 0.10.0, the system is vulnerable. Inspect ReportsUI.php for missing permission checks in customizeEEOReport and generateEEOReportPreview actions.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive EEO data, which could lead to privacy violations or data leaks. It may also enable attackers to gather aggregate demographic information that could be misused for discriminatory purposes or competitive advantage.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without proper authorization. It may also conflict with HIPAA if EEO data includes health-related information. Organizations using affected OpenCATS versions risk non-compliance with privacy regulations due to unauthorized data access.

Mitigation Strategies

Upgrade OpenCATS to version 0.10.0 or later immediately. Review and apply the security fixes from commit aa3b414 to add missing authorization checks. Ensure all AJAX endpoints and module actions enforce proper access controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...