Medium severity4.3NVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026
CVE-2026-112787
CVE-2026-112787
Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.phpnvd
- github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.phpnvd
- github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bdnvd
- github.com/opencats/OpenCATS/issues/720nvd
- github.com/opencats/OpenCATS/releases/tag/v0.10.0nvd
- www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-reports-module-eeo-reportsnvd
News mentions
0No linked articles in our index yet.