CVE-2026-49490: OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column

Published May 31, 2026

Updated

OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.

Affected Software

1 affected component

OpenCATS OpenCATS>=0.9.1a

Event History

May 31, 2026

CVE Published

via MITRE·12:07 PM

Data Sourced

via MITRE·12:07 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-49490?

CVE-2026-49490 has a severity rating of 8.1, classified as high.

How do I fix CVE-2026-49490?

To mitigate CVE-2026-49490, upgrade to the latest version of OpenCATS that addresses this SQL injection vulnerability.

What type of vulnerability is CVE-2026-49490?

CVE-2026-49490 is classified as an SQL injection vulnerability.

Who can exploit CVE-2026-49490?

CVE-2026-49490 can be exploited by authenticated attackers leveraging crafted filters.

What impact does CVE-2026-49490 have on OpenCATS?

CVE-2026-49490 allows attackers to inject SQL into the Candidates DataGrid, potentially bypassing security restrictions.