Medium severity · published Oct 20, 2026
CVE-2026-112070
Broken Access Control in extension "Analytics" (analytics)
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Extension "Analytics" · TYPO3
before 1.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112070
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112070
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-031
More from Extension "Analytics"
5.3
CVE-2026-112068
Insecure Direct Object Reference in extension "Analytics" (analytics)