CVE-2026-112787

OpenCATS versions prior to 0.10.0 are affected by a missing authorization vulnerability within the ReportsUI::handleRequest() function. This flaw allows authenticated users to bypass the required canSeeEEOInfo permission to access sensitive demographic data. Specifically, an attacker can invoke t...

CVE-2026-112787 OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...

CVE-2026-112786

OpenCATS versions before 0.10.0 are vulnerable to a missing authorization flaw in the ImportUI::handleRequest() function. This vulnerability allows authenticated users with low-level READ access to trigger the import module's revert action. By providing a specific importID, an attacker can perfor...

CVE-2026-112786 OpenCATS before 0.10.0 Missing Authorization via Import Revert Action

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported...

EUVD-2026-104918

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported...

CVE-2026-112784

The OpenCATS application, specifically versions before 0.10.0 , is vulnerable to a missing authorization flaw in the ajax/testEmailSettings.php component. This vulnerability allows any authenticated user with read-level privileges to send emails through the configured SMTP relay . Attackers can m...

CVE-2026-112784 OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...

CVE-2026-112785 OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...

CVE-2026-112785

Versions of OpenCATS prior to 0.10.0 are vulnerable to a missing authorization issue in its AJAX endpoints. This flaw allows authenticated users with READ-level privileges to perform unauthorized actions, including creating, renaming, deleting, and populating saved lists site-wide. Specifically, ...

EUVD-2026-104917

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...

EUVD-2026-104916

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...

CVE-2026-112783

OpenCATS versions prior to 0.10.0 are vulnerable to a missing authorization flaw in the ajax/deleteActivity.php and ajax/editActivity.php endpoints. This vulnerability allows READ-level users to perform unauthorized actions by supplying an arbitrary activityID via GET or POST requests. Consequent...

CVE-2026-112783 OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

EUVD-2026-104915

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

CVE-2026-30944-PoC

🔓 CVE-2026-30944 StudioCMS Privilege Escalation via Insecure API Token Generation NVD • Advisory • CWE-639 Overview The POST /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user at minimum Editor role to generate API tokens for any other user , including...

cve-2026-47777

CVE-2026-47777 — Mastodon Featured Collections Authorization Bypass Overview I responsibly disclosed a High Severity Authorization Bypass vulnerability affecting Mastodon's experimental Featured Collections federation pipeline. CVE ID: CVE-2026-47777 Affected Component...

CVE-2026-35273

🚨 CVE-2026-35273 - Oracle PeopleSoft PeopleTools Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in Oracle PeopleSoft PeopleTools A vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools that allows remote attackers to compromise vulnerable systems without...

API-Security-Checklist

繁中版 | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Deutsch | Ελληνικά | Español | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng Việt...

nextjs-cve-demo

Example: Authorization Bypass in Next.js Middleware CVE-2025-29927 This Repo provides example projects demonstrating the Middleware authorization bypass vulnerability in Next.js CVE-2025-29927. This vulnerability allows unauthorized users to access protected resources. Vulnerability Overview...

CVE-2026-112065

The sgalinski Cookie Consent extension (sg_cookie_optin ) is vulnerable to a Missing Authorization (CWE-862) flaw. Specifically, the routes providing consent history and statistics data fail to verify if the authenticated backend user has the necessary permissions to access the module or the requ...