CVE-2026-112070 — Broken Access Control in extension "Analytics" (analytics)
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7