Login Request a demo
Medium severity · published Oct 20, 2026
CVE-2026-112787
OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenCATS · opencats
before 0.10.0 · source: vendor
Affected product
OP
OpenCATS
opencats
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112787
github.com
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.php#L51-L91
github.com
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.php#L567-L722
github.com
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
github.com
https://github.com/opencats/OpenCATS/issues/720
github.com
https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
www.vulncheck.com
https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-reports-module-eeo-reports
More from OpenCATS
9.8
CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload
9.8
CVE-2022-48011
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function
9.8
CVE-2022-43019
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality
9.8
CVE-2021-41560
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php
9.8
CVE-2021-25294
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution