OpenCATS versions before 0.10.0 contain a missing authorization flaw in the ReportsUI::handleRequest() method. This gap allows any authenticated user, even those lacking the canSeeEEOInfo permission, to request EEO demographic reports. By calling the customizeEEOReport and generateEEOReportPreview actions, an attacker can retrieve aggregated data on ethnicity, veteran status, gender, and disability, thereby disclosing sensitive employee demographics that should be protected.

The vulnerability affects the OpenCATS product, specifically installations running any release prior to 0.10.0. The flaw is contained within modules/reports/ReportsUI.php as indicated by the advisory references. Any deployment that enables the EEO reports functionality and employs user authentication is vulnerable.

The CVSS score of 5.3 labels the issue as moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires only that the attacker be authenticated—often straightforward in internal or compromised environments. Once authenticated, the attacker can invoke the exposed report actions without additional steps, making the attack vector simple, low effort, and likely to be abused if left unpatched.