EUVD-2026-104915
GHSA-2rp2-4gqx-g5jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as READ-level user
-
ExploitCraft GET/POST with arbitrary activityID
-
ExecutionCall editActivity.php or deleteActivity.php
-
ImpactModify or delete candidate/contact/company history
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated OpenCATS session with at least READ-level access to the instance (PR:L); the attacker then supplies an arbitrary activityID via GET or POST to the vulnerable ajax/editActivity.php or ajax/deleteActivity.php endpoints. No user interaction, no administrative privilege, and no non-default configuration are needed - the endpoints shipped without any edit-level authorization check in versions before 0.10.0. The principal limiting factor is that valid low-privilege credentials are mandatory, so exploitation is restricted to insiders or attackers who have already obtained a READ-level account; impact is limited to editing/deleting activity and pipeline history and does not expose confidential data. |
| Impact | This is a moderate, authenticated-only data-integrity issue rather than a high-urgency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability and low complexity, but PR:L means the attacker must already hold a valid low-privilege (READ-level) account, and impact is confined to integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect and no scope change. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - this reads as a low-real-risk issue despite the medium 5.3 score, meaningful primarily to organizations where low-trust users should not be able to tamper with recruiting records. The signals are internally consistent: a missing-authorization (CWE-862) flaw fixed by adding ACCESS_LEVEL_EDIT checks, matching the PR:L/integrity-only profile. One caveat to verify: deletion of activity and pipeline history could arguably carry an availability (data-loss) dimension that the vendor-supplied vector scored as integrity-only (VA:N) - defenders concerned with record loss should weigh that. |
| Exploit ScenarioDerived | A low-privileged (READ-level) OpenCATS user, or an attacker who has obtained any such account, sends a crafted GET or POST request to ajax/editActivity.php or ajax/deleteActivity.php supplying an arbitrary activityID. Because the endpoints lacked an edit-level authorization check, the request modifies or deletes activity and pipeline history for candidates, contacts, or companies they should only be able to view. No public exploit identified at time of analysis, though the fixing commit (aa3b414c) is public and makes the missing check trivially understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Missing authorization checks in the OpenCATS ajax/deleteActivity.php and ajax/editActivity.php endpoints allow any authenticated user holding READ-level access to edit or delete activity and pipeline history for candidates, contacts and companies by supplying an arbitrary activityID through GET or POST. Only versions before 0.10.0 are affected, and exploitation requires valid low-privilege credentials, so the practical exposure is limited to insiders or attackers who already hold an account. This is an integrity-only issue: no confidential data is disclosed and no denial of service is demonstrated; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
Upgrade OpenCATS to 0.10.0 or later, which is the vendor-released patch containing the authorization checks added in commit https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd; review the release notes at https://github.com/opencats/OpenCATS/releases/tag/v0.10.0 and the VulnCheck advisory at https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-via-activity-ajax-endpoints before deploying. If upgrading immediately is not possible, reduce exposure by auditing and trimming READ-level accounts so only trusted staff hold sessions, since valid low-privilege credentials are the sole prerequisite - the trade-off is administrative overhead and reduced recruiter self-service. A web-server or reverse-proxy rule blocking POST/GET to /ajax/deleteActivity.php and /ajax/editActivity.php for non-editor users will stop the attack but breaks legitimate activity editing and deletion in the UI, so it should be treated as a temporary stopgap. After patching, review activity and pipeline history logs for unexplained deletions or edits that could indicate prior abuse of these endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenCATS is a PHP-based open-source applicant tracking system (CATS) that stores recruiting pipelines, candidate records and activity history in a backend database and exposes many operations through AJAX endpoint scripts under the ajax/ and modules/*/ajax/ directories. The root cause is CWE-862 (Missing Authorization): the deleteActivity.php and editActivity.php handlers processed the client-supplied activityID without ever calling the session-based access-level API ($_SESSION['CATS']->getAccessLevel(...)) to confirm the caller had edit rights, so any session at READ level could reach the write paths. The upstream fix (commit aa3b414c, released as v0.10.0) adds explicit checks requiring ACCESS_LEVEL_EDIT for contacts.deleteActivity and contacts.editActivity, and the same commit hardens related handlers - testEmailSettings.php (ACCESS_LEVEL_SA), calendar event edit/delete ownership checks in CalendarUI.php plus a new Calendar::get() lookup, ImportUI.php, and the lists AJAX endpoints (addToLists, deleteList, editListName, newList). This indicates a broader pattern of missing per-action authorization in the application's AJAX layer, with the activity endpoints being the specific instance tracked by this CVE.
Know when Opencats gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable AJAX endpoints with low complexity, but a valid READ-level account is required so PR:L; impact is unauthorized modification/deletion of records (I:L) with no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in OpenCATS installer allows unauthenticated attackers to inject and execute arbitrary PHP code by
OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax fu
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUti
OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. Rated cr
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary
SQL injection in OpenCATS through 0.9.7.4 allows authenticated users to extract arbitrary database contents by injecting
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying opera
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerr
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion func
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. Rated medium se
OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update functi
Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javas
Exploit-DB