CVE-2026-110621

Deferred Deferred - Pending Action

Missing Authorization in Swetrix Cloud Allows Project Hijacking

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110621

EUVD

EUVD-2026-101249

Affected Vendors & Products

Vendor	Product	Version / Range
Swetrix	swetrix	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-110621 is a missing authorization vulnerability in Swetrix Cloud versions before 5.1.0. It allows authenticated users to hijack arbitrary projects by moving them into their own organization using the project's public tracking ID. Attackers can gain full access to read analytics, modify settings, or delete the project.

Detection Guidance

To detect this vulnerability, check if your Swetrix instance is running a version before 5.1.0. Use commands like 'curl -s https://your-swetrix-domain.com/api/version' or inspect the backend code for the vulnerable endpoint POST /project/organisation/:orgId. Look for unauthorized project additions to organizations.

Impact Analysis

If you use Swetrix Cloud before version 5.1.0, an attacker with an account could hijack your projects. This means they could access your analytics data, change project settings, or even delete your projects entirely. Even if you are not targeted, the vulnerability allows unauthorized cross-tenant access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Unauthorized project hijacking may result in data breaches, non-compliance with privacy regulations, and potential legal consequences for organizations using affected Swetrix versions.

Mitigation Strategies

Upgrade Swetrix to version 5.1.0 or later immediately. Verify the fix by checking the backend code for project ownership verification in project.controller.ts. Ensure no unauthorized projects were added to your organizations during the vulnerable period.

Hi! I’m here to help you understand CVE-2026-110621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70