OpenCATS before version 0.10.0 contains a missing authorization flaw in four AJAX endpoints – newList.php, editListName.php, deleteList.php and addToLists.php. This vulnerability is an instance of the common weakness CWE‑862, Missing Authorization. The flaw allows any authenticated user with READ privileges to create, rename, delete and populate saved lists across the entire site. An attacker can, therefore, alter or destroy lists that belong to any user or group, potentially leading to loss of data, unauthorized disclosure, and undermining of the system’s data integrity.

The vulnerability affects all installations of OpenCATS with a version earlier than 0.10.0. The affected product is OpenCATS from the vendor ‘opencats’. No specific sub‑version or build data is listed beyond the pre‑0.10.0 boundary.

The CVSS score of 5.3 indicates moderate severity. EPSS information is not available, and the vulnerability is not included in the CISA KEV catalog. The attack vector is authenticated; an attacker only needs to be logged in as a READ‑level user and can directly target the exposed AJAX endpoints. While exploitation does not require special privileges beyond normal login, the ability to modify or remove any list site‑wide makes the impact significant for an affected organization.