CVE-2026-112070CWE-862broken-access-control
CVE-2026-112070
published October 20, 2026
What it is
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
The record
Technical detail
- CVSS
- 5.3 · NONE
- CVSS v4.0
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00324 · 24.2th percentile
- Weakness
- CWE-862 · Missing Authorization
- Published
- 2026-10-20T14:17Z
References (1)
EPSS history
Timeline