CVE-2026-112784 — OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP r…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7