Authorization Vulnerability in Open Web Analytics by Open Web Analytics

CVE-2026-119646

What is CVE-2026-119646?

Open Web Analytics versions before 1.14.1 are susceptible to an authorization vulnerability, allowing authenticated users to access report data from other sites. This occurs because the clickstream and transaction reports are not properly restricted to the authorized siteId. Users possessing the 'view_reports' permission for one site can leverage another site's session_id or order_id to gain unauthorized access to that site's visit history, including sensitive information such as IP addresses, user agents, and order data.

References