Medium severity4.3NVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026
CVE-2026-112783
CVE-2026-112783
Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/deleteActivity.phpnvd
- github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/editActivity.phpnvd
- github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bdnvd
- github.com/opencats/OpenCATS/issues/720nvd
- github.com/opencats/OpenCATS/releases/tag/v0.10.0nvd
- www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-activity-ajax-endpointsnvd
News mentions
0No linked articles in our index yet.