Medium severity · published Oct 20, 2026
CVE-2026-112068
Insecure Direct Object Reference in extension "Analytics" (analytics)
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Extension "Analytics" · TYPO3
before 1.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112068
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-031
More from Extension "Analytics"
5.3
CVE-2026-112070
Broken Access Control in extension "Analytics" (analytics)