CVE-2026-112784: OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCATSto a version that resolves this vulnerability.Fixed in 0.10.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenCATS user, including a user with read-level permissions, can exploit it. The attacker does not need administrative email-settings privileges.
What access and conditions are required for exploitation?
The attacker needs a valid OpenCATS account and network access to the affected application. Exploitation uses the ajax/testEmailSettings.php endpoint and the configured SMTP relay.
What can an attacker do with the vulnerable endpoint?
An attacker can send the endpoint's fixed test message to an arbitrary recipient by supplying testEmailAddress. They can also provide a spoofed From address through the fromAddress parameter.
Which versions are affected?
OpenCATS versions before 0.10.0 are affected. Version 0.10.0 is identified as the release containing the fix.