OpenCATS CVE-2026-112787

Requires a valid authenticated OpenCATS session at a low privilege level (PR:L); the attacker does not need the canSeeEEOInfo permission that normally gates EEO reporting. Exploitation consists of directly invoking the customizeEEOReport and generateEEOReportPreview actions in the reports module (ReportsUI::handleRequest) against versions before 0.10.0. Limiting factors: no anonymous/unauthenticated access is possible, exploitation only yields aggregate demographic statistics rather than individual records, and it is only meaningful on installations that actually collect EEO demographic data; applying release v0.10.0 (commit aa3b414) adds the missing access-level check.

This is a genuine but low-severity information-disclosure issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach with low attack complexity but requires an authenticated low-privileged account (PR:L), and impact is confined to low confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) and no scope change. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit code is referenced, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a missing-authorization flaw (CWE-862) exploitable only by an already-authenticated insider to read aggregate EEO demographic statistics is a real but narrow insider/privacy risk rather than a mass-exploitation threat. Note that EPSS and KEV data are entirely absent from the input, so widespread-exploitation likelihood cannot be quantified - treat the absence as missing data, not as evidence of safety or of risk.

A low-privileged authenticated OpenCATS user (e.g., a recruiter without HR/EEO rights) directly invokes the reports module's customizeEEOReport and generateEEOReportPreview actions, which fail to enforce the canSeeEEOInfo permission. The user retrieves aggregate ethnicity, veteran, gender, and disability statistics they are not authorized to see. No public proof-of-concept is referenced, but the source-level references pinpoint the unguarded code path in ReportsUI.php, making reproduction straightforward.