MEDIUM 5.3 NVD
CVE-2026-112784
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.
References
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/te
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
- https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-ajax
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-20 via NVD.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.