# CVE-2026-112784: OpenCATS missing authorization in email settings

Source: https://junglewise.ai/threats/cve-2026-112784-opencats-before-0-10-0-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112784 · Severity: medium · CVSS 4.3 · Published 2026-10-20

OpenCATS is a recruitment and applicant tracking system. An authenticated read-level user can exploit a missing authorization check to send emails through the system's configured mail relay with a spoofed sender address, potentially enabling unauthorized communication or phishing attacks.

Technologies: [OpenCATS](https://junglewise.ai/threats/technologies/opencats). Vendors: [OpenCATS](https://junglewise.ai/threats/vendors/opencats).

## Quick answers

**Is CVE-2026-112784 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112784 being exploited in the wild.

**How severe is CVE-2026-112784?** Medium severity, with a CVSS score of 4.3, published 20 October 2026.

**Which products and versions are affected?** OpenCATS before 0.10.0.

**Is there a fix for CVE-2026-112784?** Yes: fixed in 0.10.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112784 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112784?** Check whether you run OpenCATS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.10.0

## Technical details

Missing authorization checks in the ajax/testEmailSettings.php endpoint allow any authenticated user to invoke the email sending functionality without verifying edit-level permissions. An attacker with read-level access can supply arbitrary testEmailAddress and fromAddress parameters to send emails with a spoofed From header via the configured SMTP relay. The vulnerability was fixed by adding role-based access level checks to the affected AJAX endpoints.

## Affected products

- OpenCATS OpenCATS before 0.10.0

## Timeline

- 2026-10-20: disclosed

## References

- [https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/testEmailSettings.php](https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/ajax/testEmailSettings.php)
- [https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd](https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd)

## Related threats

- [OpenCATS authenticated SQL injection in date filtering](https://junglewise.ai/threats/cve-2026-54455-opencats-is-an-open-source-applicant-tracking-system-and)
- [OpenCATS code injection in Professional License configuration](https://junglewise.ai/threats/cve-2026-54453-opencats-is-an-open-source-applicant-tracking-system-and)
- [OpenCATS stored cross-site scripting in MRU navigation panel](https://junglewise.ai/threats/cve-2026-115513-opencats-before-0-12-0-contains-a-stored-cross-site-scripting)
- [OpenCATS authorization bypass in calendar event management](https://junglewise.ai/threats/cve-2026-113349-opencats-before-0-10-0-contains-a-missing-authorization)
- [OpenCATS missing authorization in reports module](https://junglewise.ai/threats/cve-2026-112787-opencats-before-0-10-0-contains-a-missing-authorization)