Access Control Flaw in TYPO3 Backend Module Exposing Site Analytics
CVE-2026-112068

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "analytics"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112068?

The TYPO3 backend module is vulnerable due to insufficient access controls, allowing users with backend access to view the analytics dashboard of any site they choose. This flaw compromises sensitive data visibility, leading to unauthorized exposure of site analytics. Proper access validation should be enforced to prevent unauthorized users from accessing potentially critical information across different sites.

Affected Version(s)

Extension "Analytics" 0 < 1.1.1

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-031
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Markus Hofmann
Simon Schmidt
Andreas Kienast
.