CVE-2026-119646: Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another site's sessionid or orderid to read its visit history, IP addresses, user agents and order data.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has the view_reports permission on at least one site can exploit it. The user does not need permission for the site whose report data is disclosed.
What information can be exposed?
An attacker can read another site's visit history, IP addresses, user-agent strings, and order data through clickstream and transaction report requests.
What identifiers does an attacker need?
The attacker supplies a siteId they are authorized to view together with a session_id or order_id belonging to another site. The affected REST report API does not correctly scope those report records to the authorized siteId.
Which versions are affected?
Open Web Analytics versions before 1.14.1 are affected. Updating to 1.14.1 or later addresses the authorization flaw.