Live › vulnerability › CVE-2026-112070
Go to dashboardThe extension's AJAX routes do not verify that a backend user has access to the related module or dashboard widget. A backend user can therefore retrieve analytics data for sites they have page access to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the affected TYPO3 extension with backend users who have limited access rights. The sources do not name the extension or its versions, so the exact range is unknown. Installations without this extension, or without backend users outside the analytics role, are unlikely to be exposed.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
This page as .md · .json · in your agent: get_signal("CVE-2026-112070")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.