CVE-2026-112787
CVE-2026-112787 · OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
CVSS 5.3 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
opencats
- Versions du logiciel
- ≥ 0, < 0.10.0: Concernée (custom)
Mettez à jour vers 0.10.0
Sources originales
- https://github.com/opencats/OpenCATS/issues/720
- https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
- https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.php#L51-L91
- https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/reports/ReportsUI.php#L567-L722
- https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-reports-module-eeo-reports
- https://nvd.nist.gov/vuln/detail/CVE-2026-112787