Access Control Flaw in TYPO3 Extension Affects User Data Retrieval
CVE-2026-112070

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "analytics"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112070?

This vulnerability in the TYPO3 extension allows unauthorized backend users to access analytics data from sites they have view access to. The AJAX routes of the extension fail to enforce proper access controls, enabling users without the necessary permissions to retrieve sensitive information associated with dashboard widgets and modules.

Affected Version(s)

Extension "Analytics" 0 < 1.1.1

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-031
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simon Schmidt
Andreas Kienast
.