CVE-2026-112787 — OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the c…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7