CVE-2026-112070
CVE-2026-112070 · Broken Access Control in extension "Analytics" (analytics)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
extension "analytics"
- Versions
- ≥ 0, < 1.1.1: Affected (semver)
Update to 1.1.1