CVE-2026-112068: Insecure Direct Object Reference in extension "Analytics" (analytics)
Published Oct 20, 2026
·Updated
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
Affected Software
1 affected component
Typo3 Analytics extension
Event History
Oct 20, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A backend user who has access to the Analytics backend module can exploit it. The user can open analytics dashboards for sites they are not authorized to access.
2
What access is required to exploit it?
The attacker needs authenticated backend access and permission to use the Analytics module. The issue does not describe unauthenticated access.