CVE-2026-112787

OpenCATS versions prior to 0.10.0 are affected by a missing authorization vulnerability within the ReportsUI::handleRequest() function. This flaw allows authenticated users to bypass the required canSeeEEOInfo permission to access sensitive demographic data. Specifically, an attacker can invoke t...

CVE-2026-112787 OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...