MEDIUMCVSS v3.1 4.3Vulnerability
CVE-2026-112785
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Cvss score
- 4.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-20T21:15:35+00:00
- Score
- 4.3
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-112785
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- First seen by Signal
- 2026-10-20T13:03:27+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Published at
- 2026-10-20T11:17:18.483
- Last modified
- 2026-10-20T17:17:31.840
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph