CVE-2026-112787

CVSS 5.3 (medium) · published 2026-10-20

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.

Weakness: CWE-862

Source: NVD CVE-2026-112787

References

• https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.php#L51-L91
• https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.php#L567-L722
• https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
• https://github.com/opencats/OpenCATS/issues/720
• https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
• https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-reports-module-eeo-reports

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.