Open Web Analytics CVE-2026-119646

Requires (1) a valid OWA account with the view_reports capability on at least one site, and (2) a multi-site OWA installation (before 1.14.1) hosting data for more than one site on the same instance, since the attacker reads a DIFFERENT site's data than the one they are authorized for. The attacker must also know or obtain a target site's session_id, order_id/transactionId, or Domstream recording guid to reference the victim record. Limiting factors: exploitation is impossible on single-site installations (no other site's data to disclose), requires authenticated access rather than being open to anonymous attackers (PR:L), and impact is read-only confidentiality disclosure with no write or availability effect. Affected: all versions before 1.14.1; fixed in 1.14.1.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium): network-reachable, low complexity, but requiring low privileges (PR:L) - the attacker must already hold a valid OWA account with the view_reports capability on at least one site. Impact is confidentiality-only and rated Low, consistent with a read-only cross-tenant data disclosure (CWE-639 / IDOR). No EPSS score was provided and the CVE is not on CISA KEV, so there is no signal of widespread or confirmed active exploitation - exploitation status is 'no public exploit identified at time of analysis' in the strict KEV/POC sense, though a public technical writeup describing the IDOR exists (hackmd) and VulnCheck published an advisory. The vuln.today Decision label is 'this_month', which aligns with the Medium severity and authenticated, single-impact nature: remediate on a normal patch cycle rather than as an out-of-band emergency. Two caveats: the disclosed data (visit history, IP addresses, user agents, and order/transaction data) is meaningful PII, so the real-world confidentiality harm may feel higher than the 'Low' CVSS impact label suggests; and exploitation is only relevant in multi-site OWA installations where more than one site's data shares the instance.

An attacker holding a legitimate low-privilege account with view_reports on one site of a shared multi-site OWA installation calls the REST report API (clickstream, transaction, or recording player endpoints), supplying their own authorized siteId together with another tenant's session_id or order_id. Because the pre-1.14.1 queries scoped by record id alone and never by site_id, the server returns the other site's visit history, IP addresses, user agents, and order data. A public technical writeup describing this cross-site IDOR exists; it is not verified as working exploit code. The low complexity and network vector make this trivially repeatable once an attacker has any valid view_reports account.