CVE-2026-78850
Received Received - Intake

Information Disclosure in Matomo Analytics Platform

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-78850
EUVD
EUVD-2026-102185

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78850 is a Server-Side Request Forgery (SSRF) vulnerability in Matomo version 5.11.2. It occurs in the SiteContentDetector component where an authenticated user with view access can trigger a blind HTTP request to an arbitrary URL set as a site's main_url. The application only validates the hostname and fails to reject internal, loopback, RFC1918, or link-local addresses after DNS resolution.

Detection Guidance

To detect this SSRF vulnerability in Matomo 5.11.2, monitor outbound HTTP requests from your Matomo server, especially to internal or unexpected IP ranges. Check server logs for requests to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local addresses (169.254.0.0/16). Use network monitoring tools like tcpdump or Wireshark to capture outbound traffic from the Matomo host.

Impact Analysis

This vulnerability allows attackers to perform blind SSRF attacks against internal services. This could enable internal network reconnaissance or interaction with services bound to private interfaces. Attackers need to observe the blind request through a controlled listener or side channel.

Compliance Impact

This vulnerability could potentially impact compliance with privacy regulations like GDPR and HIPAA by allowing unauthorized access to internal network services through blind SSRF attacks. If exploited, it may expose sensitive data or enable lateral movement within restricted environments, violating data protection requirements for confidentiality and integrity.

Mitigation Strategies
  • Upgrade Matomo to a patched version or apply the recommended remediations: resolve hostnames to IP addresses before requests, reject unsafe IP ranges, revalidate redirect targets, and use strict allowlists for outbound requests.
  • Disable the enable_internet_features setting if not required to prevent blind SSRF attacks.
  • Restrict access to the SiteContentDetector component to only necessary users.
  • Implement audit logging for all outbound HTTP requests to detect suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart