{"id":"CVE-2026-112070","kind":"vulnerability","aliases":["CVE-2026-112070"],"related":[],"title":"TYPO3 extension lets backend users read analytics beyond their module access","description":"The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.","summary":"The extension's AJAX routes do not verify that a backend user has access to the related module or dashboard widget. A backend user can therefore retrieve analytics data for sites they have page access to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","typo3"],"not_affected_if":["extension-not-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T10:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:54+00:00","updated_at":"2026-10-25T04:24:54+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:24:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"TYPO3 extension lets backend users read analytics beyond their module access","impact":"low","summary":"The extension's AJAX routes do not verify that a backend user has access to the related module or dashboard widget. A backend user can therefore retrieve analytics data for sites they have page access to.","category":"other","nicknames":[],"who_cares":["typo3","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Backend users read analytics data for sites outside their module access","analyst_note":"Identify the TYPO3 extension name and affected versions, and the fixed release, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112070.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["extension-not-installed"],"who_is_affected":"Sites running the affected TYPO3 extension with backend users who have limited access rights. The sources do not name the extension or its versions, so the exact range is unknown. Installations without this extension, or without backend users outside the analytics role, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00054,"input_tokens":3273,"output_tokens":425,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112070':14A,17A '-2026':13A,16A 'access':11A,36B,57B,72C,94C 'ajax':26B,59C 'analyt':7A,50B,86C 'backend':4A,33B,45B,69C,81C 'beyond':8A 'check':66C 'cve':12A,15A 'dashboard':42B,78C 'data':51B,87C 'extens':2A,24B,63C 'host':21B 'let':3A 'modul':10A,40B,76C 'page':56B,93C 'read':6A 'relat':39B,75C 'retriev':49B,85C 'rout':27B,60C 'self':20B 'self-host':19B 'site':53B,90C 'therefor':48B,84C 'typo3':1A,22B 'user':5A,34B,46B,70C,82C 'verifi':30B 'whether':67C 'widget':43B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running the affected TYPO3 extension with backend users who have limited access rights. The sources do not name the extension or its versions, so the exact range is unknown. Installations without this extension, or without backend users outside the analytics role, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112070","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112070","severity":null,"published_at":"2026-10-20T10:17:04+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}