CVE-2026-112786: OpenCATS before 0.10.0 Missing Authorization via Import Revert Action
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with READ-level access can exploit it. No higher privilege or user interaction is required.
What data can be affected by a successful exploit?
An attacker can roll back an import and mass-delete imported candidate, company, and contact records associated with the specified importID.
Are default deployments affected?
The available data identifies OpenCATS versions before 0.10.0 as affected, but does not state whether the vulnerable import functionality is enabled or reachable in a default deployment.
How can I determine whether my instance is vulnerable?
Check whether the OpenCATS version is earlier than 0.10.0. Also review whether READ-level users can access the import module and submit revert actions with importID values.