OpenCATS Alternatives: A 2026 Self-Hosted ATS Comparison

Most posts about OpenCATS alternatives open by telling you the project is dead. We checked before writing this one, and that's wrong. OpenCATS released v0.10.0 on 23 June 2026 — its first stable release in roughly 26 months — and the repository was last pushed on 3 August 2026.

So the framing isn't "abandoned, run away." It's more specific: the version you're running is the problem, not the project.

Disclosure: First Bridge Consulting builds custom recruitment software, so we have a commercial interest in one of the paths below. For most agencies it isn't the right one, and we've said so.

Is OpenCATS still maintained?

Yes, as of August 2026 — after a gap long enough to explain the confusion. A few hundred commits landed across 2016–2017, then it went quiet: single digits or low teens per year from 2018 through 2025, with 2020 recording one commit. Releases matched — 0.9.6 in 2021, 0.9.7.2 in 2023, 0.9.7.4 in April 2024, then nothing stable until v0.10.0.

Two things follow, in opposite directions.

Encouraging: v0.10.0's changelog reads as a security remediation list — CSRF protection on state-changing requests (flagged "high risk" in the pull request itself), XSS hardening, password storage migrated from MD5 to PHP's password_hash(), authentication required on the attachments module, restricted upload types, security headers. Each entry tells you what was missing before it.

Concerning: that work sits in very few hands. Since January 2025 one contributor accounts for the large majority of commits, with a second maintainer and a dependency bot making up most of the rest — four in total. A project sustained by one motivated volunteer can go quiet as fast as it woke up.

It's a PHP/MySQL application, dual-licensed under MPL 2.0 and the older CATS Public License 1.1a.

The liability isn't OpenCATS. It's the version on your server.

Auto-generated directories like SaaSHub and SourceForge won't tell you this — they don't read changelogs.

Search the National Vulnerability Database for OpenCATS and you get 26 results, several at CVSS 9.8: unsafe deserialisation leading to remote code execution (CVE-2021-25294), code execution via file upload (CVE-2021-41560), plus a cluster of SQL injection and stored-XSS findings against 0.9.6 and 0.9.7. More to the point in 2026: four CVEs were published between April and May 2026, including two SQL injection flaws in DataGrid handling (CVSS 8.5 and 8.1) disclosed against OpenCATS through version 0.9.7.4 — the newest stable release available at the time.

Connect that to what your ATS holds: candidate names, home addresses, work history, salary expectations, right-to-work documents, CVs. Under UK and EU GDPR that's personal data, and Article 32 requires appropriate technical measures to protect it. An internet-facing PHP application with catalogued, unpatched remote-code-execution vulnerabilities is hard to characterise as appropriate — and "we were using free software" isn't a defence a client's procurement team will accept.

So if you're on 0.9.x, your first move isn't choosing an alternative. It's getting off 0.9.x — upgrade and test, or pull the instance behind a VPN while you decide.

Is self-hosting an ATS GDPR-safer?

Not inherently, and this is the most common misconception among self-hosting agencies.

Self-hosting gives you control over data residency, no third-party sub-processor to disclose, and cleaner answers on client security questionnaires. What it doesn't give you: patching, encryption at rest, access logging, backup verification, MFA, or breach detection — all of which a reputable SaaS ATS does as a condition of staying in business.

Self-hosted, you are both the data controller and the infrastructure team, and GDPR judges outcomes rather than intentions. An unpatched instance with shared admin logins and unencrypted backups is materially less compliant than a SaaS vendor holding a SOC 2 report — even though your data never left the building. Sovereignty and security are different properties, and only one is achieved by choosing where the server lives. Getting the first without losing the second is a DevOps engineering problem with a known solution.

OpenCATS alternatives compared

Verified against each vendor's own site and repository in August 2026. Figures are published list prices where vendors publish them — several don't.

Two observations matter more than the rows.

The open-source column is thinner than it looks. Odoo, Frappe HR and OrangeHRM have recruitment modules, and none models a staffing agency. They handle we are hiring for ourselves — requisitions, applicants, interview stages — not multiple client companies, job orders against them, submission tracking, or bill/pay spread. Moving to Odoo isn't lateral; it's a downgrade in domain fit. CandidATS is a genuine fork, but its last release was 2022.

SaaS pricing varies by more than 10×. Manatal's entry tier and Loxo's Basic tier are both "a SaaS ATS," and one is roughly a tenth of the other. If you rejected SaaS on price years ago, you rejected a market that has since grown a real budget tier. Treat migration as a paid line item, though: Recruiterflow and Recruit CRM both charge for it.

What does migrating off OpenCATS involve?

The database is the good news: MySQL with a documented, inspectable schema, so your data is genuinely yours.

1. Core records — candidates, companies, contacts, job orders and the pipeline linking them. Straightforward SQL extraction; every target accepts CSV.
2. Attachments — where migrations overrun. CVs sit on the filesystem with database pointers, and after years those pointers drift: orphaned files, missing records, duplicates. Budget real time to reconcile.
3. Activity history and custom fields rarely map cleanly. Decide early what you'll accept losing — preserving everything turns a four-week migration into a six-month one.
4. Validation and cutover. Run both systems in parallel and reconcile record counts before switching the old one off.

One decision worth making deliberately: don't migrate everything. Most agencies carry years of dead candidate records they have no lawful basis to keep. A migration is the moment to apply a retention policy — cutting scope and GDPR exposure at once.

Self-hosted vs cloud: total cost over three years

An eight-seat agency at the list prices above, over 36 months:

Self-hosting wins on the spreadsheet, and the comparison is incomplete in a specific way. The server is minor. The real cost is the maintenance nobody books: PHP and MySQL upgrades, patching within days of disclosure rather than months, backup restore testing, monitoring, and periodic major migrations like 0.9.x to v0.10.0 — realistically several engineer-days a year in steady state, which is our estimate from doing this work, not a published benchmark.

With someone in-house who enjoys it, the economics stay excellent. With nobody owning it, the true cost surfaces as an unpatched CVE sitting on a public IP for eighteen months. The question isn't "which is cheaper." It's "who patches it, and how fast?"

The three honest paths

1 — Migrate to SaaS. Right for most agencies here. If your requirements are ordinary — candidates, clients, job orders, submissions, a careers page — a staffing-native SaaS ATS does it well, patches itself and carries the compliance burden. At the budget tier, three-year cost is competitive with self-hosting once you price your own time.

2 — Stay self-hosted, maintained properly. Legitimate if data residency is contractual, if you have real internal ops capability, or if per-seat pricing doesn't work at your headcount. The commitment: upgrade to v0.10.0, subscribe to security disclosures, treat patching as a scheduled task. Forking only pays if you've already modified core.

3 — Commission a build. The narrowest case, and we'll be specific because we sell it. Replacing OpenCATS with a full custom ATS is almost always a bad trade against a $15–$149 per-seat product. What justifies a build is workflow no vendor models: per-client bill-rate tier logic, niche compliance credentialing, white-label client portals, VMS submission formatting. Even then the better move is usually a bolt-on — keep SaaS as the system of record and build only the missing layer. Full reasoning in build vs buy.

Agencies on OpenCATS are unusually well-qualified buyers for path 3 — you already self-host, own your data, and declined per-seat pricing. That doesn't make a build right; it means that when it is, you're the shop it works for.

FAQ

Is OpenCATS abandoned? No. v0.10.0 shipped 23 June 2026 and commits continued through August 2026. But it was close to dormant from 2018 to 2025, and the revival depends heavily on one contributor.

Is OpenCATS secure? v0.10.0 cleared significant security debt. Older 0.9.x releases carry catalogued vulnerabilities including several rated CVSS 9.8, with SQL injection disclosed against versions through 0.9.7.4 as recently as May 2026. If you haven't upgraded, treat it as urgent.

Can I keep self-hosting safely? Yes, with discipline: run v0.10.0 or later, patch on a schedule, put the instance behind a VPN or WAF, enforce MFA, encrypt and test backups.

Deciding whether to migrate, maintain, or build? First Bridge Consulting runs a staffing desk and builds software, so we'll tell you plainly when a SaaS ATS is the right answer — the outcome we recommend most often. When it isn't, we build the layer your ATS is missing. See custom recruitment software and software development, or email success@firstbridgeconsulting.com. Talk to us →

Sources

• OpenCATS on GitHub — releases, commit history and v0.10.0 changelog
• NVD keyword search: OpenCATS
• Vendor pricing pages checked August 2026: Recruiterflow, Loxo, Crelate, Manatal, Bullhorn, Zoho Recruit, JobAdder
• Workable — data migration from a prior ATS