CVE-2026-112784

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to 0.10.0

Description An authorization flaw exists in the 'ajax/testEmailSettings.php' endpoint. This issue allows any authenticated user, including those with read-only permissions, to send emails via the configured SMTP relay. By manipulating the testEmailAddress and fromAddress parameters, an attacker can send a predefined test message to any recipient while spoofing the sender address.

Recommendations Update to version 0.10.0 or later. Restrict access to the 'ajax/testEmailSettings.php' endpoint to prevent unauthorized email transmission.