---
id: CVE-2026-112785
title: OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
summary: >-
  OpenCATS before 0.10.0 contains a missing authorization vulnerability that
  allows READ-level users to create, rename, delete, and populate saved lists
  via AJAX endpoints. Authenticated attackers can send requests to newList.php,
  editList…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: opencats
product: OpenCATS
affected:
  - OpenCATS < 0.10.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T10:41:33.992Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112785'
references:
  - url: 'https://github.com/opencats/OpenCATS/issues/720'
  - url: >-
      https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
  - url: 'https://github.com/opencats/OpenCATS/releases/tag/v0.10.0'
    label: OpenCATS v0.10.0 Release Notes
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/lists/ajax/deleteList.php
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/lists/ajax/newList.php
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/lists/ajax/editListName.php
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/lists/ajax/addToLists.php
  - url: >-
      https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-saved-list-ajax-endpoints
    label: >-
      VulnCheck Advisory: OpenCATS before 0.10.0 Missing Authorization in
      Saved-List AJAX Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.326Z'
---

## Overview

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

## Affected

- `OpenCATS < 0.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.