CVE-2026-112068
Insecure Direct Object Reference in extension "Analytics" (analytics)
TYPO3 Extension "Analytics"Applications & CMS
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.1.1Extension "Analytics"CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
Text from CVE List
Affected versions 1
- Extension "Analytics"affected: all versions before 1.1.1CVE List