OpenCATS versions prior to 0.10.0 expose a missing authorization check in the ajax/testEmailSettings.php endpoint. Any authenticated user with read-level permissions can submit arbitrary testEmailAddress and fromAddress parameters, causing the application to send a test email through the configured SMTP relay. The attacker can spoof the From header and target any recipient, potentially facilitating spam, phishing, or other email-based attacks. The vulnerability does not allow code execution or direct system compromise beyond the ability to send email messages.

The affected system is the OpenCATS application (opencats:OpenCATS). All releases before version 0.10.0 are vulnerable. Users running 0.9.x or earlier versions should verify their installed version and consider upgrading if it is older than 0.10.0.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated web user making an AJAX request to testEmailSettings.php; no special privileges beyond standard authenticated access are required. An attacker with access to the web application can exploit this flaw to relay email messages to arbitrary recipients using a spoofed From address.