Medium 4.3

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level...

CVE-2026-112785 First seen on SecPulse Oct 20, 20:17

Original description The description as published by the source.

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

Source: NIST National Vulnerability Database NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: Oct 20, 2026
First seen on SecPulse: Oct 20, 20:17
GHSA: GHSA-q7v9-9q5g-w293
CWE: CWE-862

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

PHP

CWE

Cwe 862

Detection sources

NIST National Vulnerability DatabaseOct 20, 20:17
GitHub Security Advisories (Global)Oct 20, 21:31