CVE-2026-112783

CVSS 5.3 (medium) · published 2026-10-20

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.

Weakness: CWE-862

Source: NVD CVE-2026-112783

References

• https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/deleteActivity.php
• https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/editActivity.php
• https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
• https://github.com/opencats/OpenCATS/issues/720
• https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
• https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-activity-ajax-endpoints

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.