CVE-2026-110621
Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
Swetrix swetrix
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.1.0swetrixCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
Text from CVE List
Affected versions 1
- swetrixaffected: all versions before 5.1.0CVE List
References 5
- github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588Fixvia CVE List
- github.com/Swetrix/swetrix/releases/tag/v5.1.0Fixvia CVE List
- vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organisation-orgidAdvisoryvia CVE List
- github.com/Swetrix/swetrix/issues/477Referencevia CVE List
- github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts#L888-L920Referencevia CVE List