CVE-2026-112786
5.4 MEDIUMpublic exploit availablePublished 2026-10-20 · Updated 2026-10-20
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-862
Public exploit & PoC references
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/import/ImportUI.php#L155-L188
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
All references
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/import/ImportUI.php#L155-L188
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
- https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-import-revert-action
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-14484
- MEDIUMCVE-2025-14486
- MEDIUMCVE-2025-14487
- MEDIUMCVE-2025-7043
- HIGHCVE-2025-71433PoC
- MEDIUMCVE-2026-0198
- HIGHCVE-2026-100217
- CRITICALCVE-2026-100240
Related by shared AI tags and CWE weakness class. Browse the full archive.