# CVE-2026-112786: OpenCATS missing authorization in import rollback

Source: https://junglewise.ai/threats/cve-2026-112786-opencats-before-0-10-0-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112786 · Severity: medium · CVSS 5.4 · Published 2026-10-20

OpenCATS is a web-based applicant tracking system used by recruiters to manage candidates and job orders. A low-privileged authenticated user can exploit missing authorization checks in the import module to roll back and mass-delete imported candidate, company, and contact records, causing permanent data loss.

Technologies: [OpenCATS](https://junglewise.ai/threats/technologies/opencats). Vendors: [OpenCATS](https://junglewise.ai/threats/vendors/opencats).

## Quick answers

**Is CVE-2026-112786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112786 being exploited in the wild.

**How severe is CVE-2026-112786?** Medium severity, with a CVSS score of 5.4, published 20 October 2026.

**Which products and versions are affected?** OpenCATS before 0.10.0.

**Is there a fix for CVE-2026-112786?** Yes: fixed in 0.10.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112786 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112786?** Check whether you run OpenCATS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.10.0

## Technical details

The ImportUI::handleRequest() method fails to properly authorize the revert action on imported data. An authenticated user with READ-level access can craft a request with an importID parameter to trigger the import rollback function without permission checks, allowing deletion of candidate, company, and contact records created during that import.

## Affected products

- OpenCATS OpenCATS before 0.10.0

## Timeline

- 2026-10-20: disclosed
- 2026-05-26: patched: Commit aa3b414 added missing authorization checks

## References

- [https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/import/ImportUI.php](https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/import/ImportUI.php)
- [https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd](https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd)

## Related threats

- [OpenCATS authenticated SQL injection in date filtering](https://junglewise.ai/threats/cve-2026-54455-opencats-is-an-open-source-applicant-tracking-system-and)
- [OpenCATS code injection in Professional License configuration](https://junglewise.ai/threats/cve-2026-54453-opencats-is-an-open-source-applicant-tracking-system-and)
- [OpenCATS stored cross-site scripting in MRU navigation panel](https://junglewise.ai/threats/cve-2026-115513-opencats-before-0-12-0-contains-a-stored-cross-site-scripting)
- [OpenCATS authorization bypass in calendar event management](https://junglewise.ai/threats/cve-2026-113349-opencats-before-0-10-0-contains-a-missing-authorization)
- [OpenCATS missing authorization in reports module](https://junglewise.ai/threats/cve-2026-112787-opencats-before-0-10-0-contains-a-missing-authorization)