OpenCATS EUVD-2026-103385

Exploitation requires the OpenCATS Career Portal with candidate registration enabled - per the patch documentation this feature is DISABLED BY DEFAULT, so default internal installations are not exposed. The attacker POSTs to the public candidateLogin endpoint (index.php?m=careers&p=candidateLogin&ID=<jobOrderID> or careers/index.php) and repeatedly submits candidate verification data; the weakness is that OpenCATS enforces no application-level attempt counter, delay, or rate limiter (the maintainer confirms this is deliberately out of scope). Limiting factors that reduce realistic risk: the feature must be explicitly enabled and publicly exposed, each attempt must pass the CAPTCHA (reflected as AC:H / high attack complexity), the verification fields are low-entropy but still require a plausible match, and the maintainer recommends deploying nginx/mod_security/HAProxy/WAF rate limiting (~5-10 attempts/min/IP) at the proxy layer as the intended mitigation.

Signals are consistent and point to a genuine-but-modest issue rather than an urgent priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L, base 6.3 Medium) describes a network-reachable, unauthenticated weakness with only LOW confidentiality impact and no integrity or availability impact - and critically AC:H, reflecting the CAPTCHA that must be solved on each attempt. The E:P exploit-maturity flag plus the published gist confirm publicly available exploit code exists, but there is no CISA KEV listing and no EPSS value was supplied, so there is no evidence of active or widespread exploitation. The SSVC framework was not provided. A notable conflict: the single CVSS confidentiality hit (VC:L) and CWE-307 (improper restriction of excessive authentication attempts / brute force) describe a rate-limiting weakness, yet the maintainer explicitly declined to treat application-level rate limiting as in-scope, arguing it belongs at the reverse-proxy/WAF layer - meaning the 'fix' changes the authentication model (server-side identity, mandatory CAPTCHA) rather than adding attempt counters. Net: real but low-to-moderate priority, blunted by AC:H, low impact, POC-only maturity, a default-disabled feature, and a small deployment footprint.

An attacker locates an OpenCATS instance that has the optional Career Portal / candidate registration feature enabled and repeatedly POSTs to the candidateLogin endpoint, brute-forcing the low-entropy candidate verification fields (email, last name, postcode) because the application enforces no attempt throttling. Published exploit code exists (a public gist), but each attempt must still satisfy the CAPTCHA, which is why the vector is rated high-complexity (AC:H) and impact is limited to disclosure of a matched candidate's profile details.