OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub