OpenCATS versions prior to 0.10.0 contain a missing authorization flaw in the ImportUI::handleRequest() routine. The flaw permits authenticated users with only READ level permissions to trigger the import module’s revert action by submitting an importID. When invoked, the revert action deletes all records that were imported in that batch, including candidates, companies, and contacts. The vulnerability therefore results in unintentional data loss rather than disclosure or code execution.

All installations of OpenCATS published before the 0.10.0 release are affected. The vulnerability applies broadly across the entire platform and does not target a specific sub‑product, so any version older than 0.10.0 is at risk.

The CVSS score of 5.3 places the flaw in the moderate range. Exploitation requires a valid account, but READ‑level users are plentiful in many setups, making the attack vector readily achievable. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can simply send a request to the import revert endpoint with a valid importID, bypassing standard permission checks.