TYPO3 Analytics CVE-2026-112070

Requires a valid, authenticated TYPO3 backend user account (PR:L) with page access to at least one site, and the 'analytics' extension must be installed and active. The attacker directly calls the extension's AJAX routes, which perform no authorization check against the backend module or dashboard widget, to read analytics data they are not entitled to. Limiting factors: exploitation is impossible without prior backend credentials, there is no path for anonymous or unauthenticated attackers, and exposure is bounded to analytics of sites to which the user already holds some page access.

This is a low-to-moderate priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) shows an authenticated backend user with low privileges can exploit it easily over the network with no user interaction, but PR:L is the critical limiter - this is a post-authentication broken-access-control flaw (CWE-862, Missing Authorization), not a path to initial access. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or automated exploitation; the realistic threat is a malicious or curious insider rather than mass internet exploitation. Impact is confined to confidentiality of analytics data for sites the user already has page access to (VC:L), so the exposure is incremental rather than wholesale. One conflict to verify: the input CVSS 4.0 vector sets VI:L (integrity impact), but the description describes read-only retrieval of analytics data only, implying confidentiality impact with no integrity change - verify with the TYPO3 advisory, as the integrity metric appears overstated.

A low-privileged TYPO3 backend user who should only see their own site's modules directly invokes the analytics extension's AJAX endpoints, which fail to verify module or dashboard-widget authorization, and reads analytics data for sites or widgets they are not permitted to view. Because the AJAX routes skip the access check entirely, no privilege escalation or credential theft is needed - only a valid backend session. No public exploit code was identified at time of analysis.