OpenCATS CVE-2026-115513

Requires a valid low-privileged authenticated OpenCATS account (before v0.12.0) that can create or rename a Candidate, Company, Contact, Job Order, or List; the attacker places an HTML/JavaScript payload in that name/title field, which lib/MRU.php's getFormatted() stores unsanitized and renders unescaped in the 'Recent' (MRU) navigation panel shown on nearly every page. Exploitation is LIMITED by three factors: (1) an authenticated account is required (PR:L), so this is not remote-unauthenticated; (2) a second user must actually view the poisoned record for the script to fire (UI:P), making it a stored/second-order trigger; (3) meaningful escalation depends on the viewing user being privileged (e.g. a Site Administrator) for session theft to yield full administrative control. The payload must also fit within the MRU item length limit (MRU_ITEM_LENGTH), as shown by the vendor's test harness.

This is a genuine but moderate-priority issue, not a drop-everything emergency, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) describes a network-reachable, low-complexity stored XSS that requires a low-privileged authenticated account (PR:L) and passive victim interaction (UI:P) - someone must view the poisoned 'Recent' panel. The vendor-supplied score of 6.3 (Medium) is driven by the subsequent-system impact (SC:H/SI:H) rather than direct impact (VC:N/VI:N/VA:N), reflecting that the real damage is session/cookie theft and privilege escalation in the victim's browser context rather than a direct compromise of the vulnerable component itself. The vuln.today decision label is 'this_month', consistent with a patchable authenticated flaw that is not under active exploitation. No EPSS score was provided and there is no KEV listing, so there is no evidence of in-the-wild exploitation. No standalone exploit/PoC reference is present - only the fix commit, the release, and a VulnCheck advisory - so the realistic risk is targeted abuse by an insider or a compromised low-privilege account rather than widespread opportunistic attacks. The escalation path is real and well-evidenced by source code (the fix wraps dataItemText in Template::escapeHtml), so defenders with multi-user OpenCATS instances should patch within a normal maintenance window.

A low-privileged authenticated OpenCATS user creates or renames a Candidate, Company, Contact, Job Order, or List so its name contains a JavaScript payload (e.g. an svg/onload handler). Because the name is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel shown on nearly every page, the script executes in the browser of any other user - including a Site Administrator - who views that record, enabling session/cookie theft and takeover of the admin account. No public exploit identified at time of analysis, though the fix commit and VulnCheck advisory describe the mechanism precisely.