{"id":"CVE-2026-112783","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-112783","generatedAt":"2026-10-28T01:52:12.537Z","title":"OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries.","description":"OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.","published":"2026-10-20T11:17:18.000Z","lastModified":"2026-10-22T22:18:02.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-862"],"affected":[],"epss":{"score":0.00255,"percentile":0.16966,"date":"2026-10-26","history":[{"date":"2026-10-21","score":0.00204,"percentile":0.09816}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-20T11:17:18.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-20T11:17:18.113Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/deleteActivity.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/editActivity.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/issues/720","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/releases/tag/v0.10.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-activity-ajax-endpoints","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-112783","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}