CVE-2026-112070

Broken Access Control in extension "Analytics" (analytics) PUBLISHED

Description (CNA)

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "Analytics"	affected 0 before 1.1.1

CWE

CWE-862

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-031

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.