CVE-2026-115513 opencats CVE debrief

Who should care

Defenders responsible for OpenCATS installations, especially those with user-accessible record creation or editing capabilities, should assess exposure and verify the effectiveness of current security controls against this type of attack.

Why it matters

This stored XSS vulnerability in OpenCATS before version 0.12.0 allows attackers to execute arbitrary JavaScript in user sessions, potentially leading to session/cookie theft and privilege escalation. Defenders should prioritize verifying exposure and assessing the effectiveness of current security controls.

• Session/cookie theft through JavaScript execution in user sessions
• Privilege escalation to full administrative control
• Potential for lateral movement within the application
• Need for verification of OpenCATS version and exposure

Technical summary

The vulnerability exists in OpenCATS before version 0.12.0, where a low-privileged authenticated user can inject HTML/JavaScript payloads into certain fields, which are then rendered unescaped in the 'Recent' (MRU) navigation panel. This allows attackers to execute arbitrary JavaScript in the session of any other user, including Site Administrators, potentially leading to session/cookie theft and privilege escalation. The affected fields include Candidate, Company, Contact, Job Order, or List name/title fields. Defenders should prioritize verifying exposure of OpenCATS installations, especially those with user-accessible record creation or editing capabilities, and assess the effectiveness of current security

Defensive priority

Defenders should prioritize verifying exposure of OpenCATS installations, especially those with user-accessible record creation or editing capabilities, and assess the effectiveness of current security controls against this type of attack.

Recommended defensive actions

• Verify OpenCATS version and ensure it is 0.12.0 or later
• Restrict user privileges to minimize exposure
• Implement additional security controls to detect and prevent XSS attacks
• Monitor user activity and system logs for suspicious behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in OpenCATS before version 0.12.0, the affected fields, and potential impact. However, specific instances of exploitation or victim organizations are not mentioned.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.