CVE-2026-49490: OpenCATS SQL Injection Vulnerability

CVE-2026-49490 Overview

CVE-2026-49490 is an SQL injection vulnerability in OpenCATS, an open-source applicant tracking system. The flaw affects OpenCATS from version 0.9.1a and exists in the DataGrid filter handling logic. Authenticated attackers can inject arbitrary SQL by crafting filter requests that target the non-filterable Tags column in the Candidates DataGrid. The vulnerability bypasses the application's column filterable restrictions, allowing direct SQL execution against the backend database. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the OpenCATS database, leading to disclosure or modification of candidate records, credentials, and other sensitive applicant tracking data.

Affected Products

OpenCATS version 0.9.1a and later releases prior to the patched version
Deployments exposing the Candidates DataGrid interface to authenticated users
Self-hosted OpenCATS instances reachable over the network

Discovery Timeline

2026-05-31 - CVE-2026-49490 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-49490

Vulnerability Analysis

The vulnerability resides in OpenCATS' DataGrid filter processing component. OpenCATS uses a DataGrid abstraction to render tabular data such as the Candidates list, where individual columns are configured as filterable or non-filterable. The Tags column is declared non-filterable, meaning the application's UI does not expose a filter input for it.

The server-side handler does not enforce the non-filterable property when processing filter parameters received in HTTP requests. An authenticated attacker can craft a filter request that references the Tags column and embeds SQL syntax inside the filter value. The filter value reaches the SQL query construction path without parameterization or proper escaping.

Because the resulting SQL statement runs with the privileges of the OpenCATS database account, an attacker can read arbitrary tables, modify records, or extract password hashes. Successful exploitation requires only low-privileged authenticated access [CWE-89].

Root Cause

The root cause is a server-side trust boundary violation. OpenCATS relies on the client-side filterable flag to determine which columns accept filter input, but the back-end DataGrid filter handler concatenates user-supplied filter values into SQL queries without validating that the targeted column is permitted for filtering. This allows attackers to reach SQL injection sinks by submitting filters for columns the UI never exposes.

Attack Vector

Exploitation occurs over the network against the OpenCATS web interface. The attacker authenticates with any valid OpenCATS account, then issues a crafted POST or GET request to the Candidates DataGrid endpoint specifying the Tags column as the filter target. The injected SQL payload is appended to the generated query and executed against the underlying database. No user interaction beyond the attacker's own session is required. Refer to the GitHub Security Advisory GHSA-gmpc-j6h7-vw74 and the VulnCheck SQL Injection Advisory for additional technical details.

Detection Methods for CVE-2026-49490

Indicators of Compromise

HTTP requests to Candidates DataGrid endpoints containing filter parameters referencing the Tags column, which the UI never generates legitimately.
Filter parameter values containing SQL meta-characters such as single quotes, UNION, SELECT, --, or /* comments.
Database error messages or unusually long query execution times correlated with DataGrid requests in OpenCATS logs.

Detection Strategies

Inspect web server access logs for filter requests where the column identifier maps to non-filterable fields in the OpenCATS configuration.
Deploy a Web Application Firewall (WAF) rule that flags SQL keywords inside DataGrid filter parameters.
Correlate authenticated session activity with anomalous database query patterns, such as queries selecting from user or credential tables originating from the application service account.

Monitoring Recommendations

Forward OpenCATS application logs and database query logs to a centralized SIEM for analysis and retention.
Alert on repeated 500-class HTTP responses from DataGrid endpoints, which often indicate failed injection attempts.
Track authentication events that precede DataGrid filter abuse to scope affected user accounts during incident response.

How to Mitigate CVE-2026-49490

Immediate Actions Required

Upgrade OpenCATS to the fixed release referenced in GHSA-gmpc-j6h7-vw74.
Restrict access to the OpenCATS web interface to trusted networks or VPN until patches are applied.
Audit OpenCATS user accounts and revoke unused or shared credentials that could be leveraged for authenticated exploitation.
Review database logs for evidence of unauthorized SELECT, UNION, or data-modifying statements originating from the OpenCATS service account.

Patch Information

The OpenCATS maintainers have published the fix in the upstream repository. Administrators should follow the remediation steps in the GitHub Security Advisory and apply the patched release. The fix enforces the filterable attribute server-side so filter parameters targeting non-filterable columns are rejected before reaching the SQL query builder.

Workarounds

Place the OpenCATS application behind a WAF with rules that block SQL keywords and metacharacters in filter parameters.
Reduce the privileges of the OpenCATS database account to the minimum required, limiting the impact of successful injection.
Temporarily disable or restrict access to the Candidates DataGrid for users who do not require it.

bash

# Example WAF/nginx rule to block SQL keywords in DataGrid filter parameters
location ~* /index\.php {
    if ($args ~* "(filter\[\w+\]=.*(union|select|sleep|--|/\*))") {
        return 403;
    }
}