CVE-2026-112785: OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenCATS user with READ-level access can exploit it. The attacker does not need elevated privileges or user interaction.
What access or conditions are required for exploitation?
The vulnerable AJAX endpoints must be reachable to an authenticated READ-level user. The attacker needs a savedListID and can submit requests to newList.php, editListName.php, deleteList.php, or addToLists.php.
What is the practical impact?
An attacker can create saved lists, rename or delete existing saved lists, and add items to lists across the site. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.
Which deployments are affected?
OpenCATS versions before 0.10.0 are affected. Version 0.10.0 is identified by the provided release reference as the fixed release.