CVE-2026-112070
Received Received - Intake

Backend User Access Bypass in Matomo Analytics Extension

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112070
EUVD
EUVD-2026-104862

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TYPO3 Extension "Analytics" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the AJAX routes of a TYPO3 extension called Analytics. These routes fail to verify if a backend user has proper access permissions for the related module or dashboard widget. As a result, any backend user with page access can retrieve analytics data from sites they are authorized to view.

Impact Analysis

Unauthorized users with backend access could view sensitive analytics data they are not permitted to see. This could lead to data leaks, privacy violations, or misuse of information if the analytics contain confidential or proprietary data.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data. Organizations may face legal penalties, loss of trust, and compliance failures if such breaches occur due to insufficient access controls.

Mitigation Strategies

Update the TYPO3 Extension 'Analytics' to the latest patched version immediately. Review and restrict backend user permissions to ensure only authorized users can access analytics data. Monitor network traffic for unusual requests to AJAX routes related to analytics.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart