CVE-2026-112070: Broken Access Control in extension "Analytics" (analytics)
Published Oct 20, 2026
·Updated
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Affected Software
1 affected component
Typo3 Analytics
Event History
Oct 20, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker needs a backend user account and page access to the affected sites. The issue is limited to analytics data for sites the backend user can access.
2
Does this allow access to analytics data for every site in the TYPO3 instance?
No. The available information states that a backend user can retrieve analytics data only for sites where they have page access.