CVE-2026-112070
Broken Access Control in extension "Analytics" (analytics)
TYPO3 Extension "Analytics"Applications & CMS
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.1.1Extension "Analytics"CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Text from CVE List
Affected versions 1
- Extension "Analytics"affected: all versions before 1.1.1CVE List