The flaw exists in the open Source Applicant Tracking System (OpenCATS) AJAX endpoints for deleting and editing activity records. Users with any authentication level, including those that are granted only read permissions, are able to send arbitrary activity identifiers via HTTP GET or POST. This lack of server‑side authorization allows an attacker to modify or delete activity entries and their associated pipeline history for enterprise entities such as candidates, contacts and companies, thereby violating data integrity and potentially enabling further manipulation of the system’s state.

The vulnerability affects all instances of the open CATS application prior to version 0.10.0. The affected product is OpenCATS, published by the openCATS organization. No specific sub‑versions beyond the pre‑0.10.0 boundary are listed; any release before that threshold is susceptible.

The calculated CVSS score of 5.3 indicates a medium severity level. Because the exploit requires only an authenticated user account – which many organizations possess – the risk of exploitation is elevated for environments where read‑only accounts are widely used. EPSS data is not available, so the current exploitation probability is unknown, but the lack of authorization checks renders the vulnerability easily exploitable once a valid credential is present. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread active exploitation yet, yet the mere presence of this flaw carries interpretational significance for organizations running older OpenCATS deployments.