Medium 4.3

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest...

CVE-2026-112787 First seen on SecPulse Oct 20, 20:17

Original description The description as published by the source.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.

Source: NIST National Vulnerability Database NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.3; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: Oct 20, 2026
First seen on SecPulse: Oct 20, 20:17
GHSA: GHSA-hfjp-88cg-xwf4
CWE: CWE-862

NVD GitHub Advisory

Tags(click for explanation)

CWE

Cwe 862

Detection sources

NIST National Vulnerability DatabaseOct 20, 20:17
GitHub Security Advisories (Global)Oct 20, 21:31