CVE-2026-112786

MediumCVSS 5.4/10Last modified Oct 20, 2026

Description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1127874.3OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view CVE-2026-1127894.7Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attackCVE-2026-112798.8Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-1127907.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1127917.0Time-of-check time-of-use (toctou) race condition in Windows Print Spooler Components allows an authorized attacker to elevate privileges loCVE-2026-1127927.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1127937.5Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network.CVE-2026-1127947.8Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.CVE-2026-1127956.5Untrusted pointer dereference in Windows Security Account Manager allows an authorized attacker to deny service over a network.CVE-2026-1127967.0Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally.CVE-2026-1127977.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1127987.0Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.
CVE-2026-112786: Medium severity, CVSS 5.4 | Vulnix