CVE-2026-112786OpenCATS before 0.10.0 Missing Authorization via Import Revert Action

Description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/opencats/OpenCATS/issues/720 issue-tracking
• https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd patch
• OpenCATS v0.10.0 Release Notes release-notes
• https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/import/ImportUI.ph… technical-description
• VulnCheck Advisory: OpenCATS before 0.10.0 Missing Authorization via Import Revert Action third-party-advisory