PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49490 OpenCATS CVE debrief

OpenCATS versions from 0.9.1a contain an authenticated SQL injection vulnerability in DataGrid filter handling. The flaw exists in the Candidates DataGrid where the non-filterable Tags column can be targeted through crafted filter requests, allowing attackers to bypass column filterable restrictions and execute arbitrary SQL queries against the database. The vulnerability requires authentication but can lead to significant confidentiality and integrity impacts on the underlying database.

Vendor
OpenCATS
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-31
Original CVE updated
2026-07-22
Advisory published
2026-05-31
Advisory updated
2026-07-22

Who should care

Organizations running OpenCATS 0.9.1a or later for applicant tracking and recruitment management. Database administrators responsible for OpenCATS backend security. Security teams monitoring for authenticated SQL injection vectors in PHP-based web applications.

Technical summary

The vulnerability resides in OpenCATS DataGrid filter processing where the Tags column in the Candidates DataGrid, designated as non-filterable, can be manipulated through crafted HTTP requests. The filter handling logic fails to properly validate or restrict filter parameters, allowing SQL injection payloads to bypass intended column restrictions. An authenticated attacker can construct malicious filter requests that execute arbitrary SQL against the database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects network accessibility, low attack complexity, low privilege requirements, and high impacts to confidentiality and integrity with no availability impact.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches from the OpenCATS project when available, monitoring the GitHub security advisory for updates
  • Restrict network access to OpenCATS instances to authorized users and trusted networks
  • Review database query logs for anomalous filter requests targeting the Candidates DataGrid Tags column
  • Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in DataGrid filter parameters
  • Validate that DataGrid filter restrictions are properly enforced server-side for all columns including Tags
  • Conduct database integrity checks and review for unauthorized data access if exploitation is suspected

Evidence notes

Vulnerability confirmed through official GitHub security advisory (GHSA-gmpc-j6h7-vw74) and Vulncheck advisory. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction needed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49490 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49490

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49490 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49490

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.