MEDIUM 5.3 NVD
CVE-2026-112787
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic repo
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
References
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-20 via NVD.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.