PT-2026-118328

CVE-2026-112783

Published

2026-10-20

Updated

2026-10-20

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to 0.10.0

Description Missing authorization in the 'ajax/deleteActivity.php' and 'ajax/editActivity.php' endpoints allows users with READ-level permissions to modify or delete activity entries. Authenticated attackers can provide an arbitrary activityID via GET or POST requests to alter or remove activity and pipeline history associated with candidates, contacts, and companies.

Recommendations Update to version 0.10.0 or later. Restrict access to the 'ajax/deleteActivity.php' and 'ajax/editActivity.php' endpoints to prevent unauthorized modifications.

Exploitability

Exploit

Fix

Impacts

Researchers

Leediay153

Lighthousekeeper1212

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers