{"id":"CVE-2026-112070","published":"2026-10-20T10:17:04.270","lastModified":"2026-10-20T19:28:52.970","description":"The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-031","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}