CVE-2026-112068
Received Received - Intake

Unauthorized Site Access in Analytics Module

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112068
EUVD
EUVD-2026-104871

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TYPO3 Extension "Analytics" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) and Broken Access Control issue in the TYPO3 extension 'Analytics'. It allows backend users with module access to view analytics dashboards for any site, not just those they are authorized to access.

Detection Guidance

Check installed versions of the TYPO3 extension 'Analytics' using commands like 'composer show typo3/analytics' or inspecting the TYPO3 backend for the extension version. Compare against version 1.1.1 to identify vulnerable installations.

Impact Analysis

Unauthorized users could access sensitive analytics data from other sites, potentially exposing confidential information. This could lead to data breaches or misuse of analytics insights.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data, potentially leading to non-compliance and legal consequences.

Mitigation Strategies

Update the TYPO3 extension 'Analytics' to version 1.1.1 or later immediately. Remove or disable the extension if updating is not possible. Restrict backend user permissions to only necessary sites.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112068. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart