CVE-2026-112787: OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenCATS user may be able to exploit it, including users who do not have the canSeeEEOInfo permission. The attacker needs access to the application and can invoke the customizeEEOReport or generateEEOReportPreview actions.
What information could be exposed?
The issue exposes aggregate EEO demographic report data, including ethnicity, veteran status, gender, and disability statistics. The provided data does not indicate exposure of individual-level records.
Which installations are affected?
OpenCATS versions before 0.10.0 are affected. Version 0.10.0 is identified as the release containing the fix.