CVE-2026-110621: Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
Published Oct 14, 2026
·Updated
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
Affected Software
1 affected component
Swetrix Swetrix Cloud<5.1.0
Event History
Oct 14, 2026
CVE Published
via MITRE·02:16 PM
Data Sourced
via MITRE·02:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated Swetrix Cloud user can exploit it. The attacker can create their own organisation and submit a victim project's public tracking ID.
2
What access could an attacker gain over a hijacked project?
An attacker can move the project into their own organisation, allowing them to read its analytics, change its settings, or delete it.
3
Are projects identified by secret credentials for this attack?
No. The described attack uses the victim project's public tracking ID.