Matomo CVE-2026-78850

Requires an authenticated session with at least low-privilege access to the Matomo administration interface (PR:L) and the ability to reach the SiteContentDetector/SitesManager functionality, which normally accepts a site URL for content detection - that URL-fetching feature is the exploitation surface. Limiting factors: exploitation is not possible against a fully anonymous attacker (valid credentials or an account are needed), there is no user interaction requirement, and impact is confined to limited information disclosure (C:L, no integrity or availability impact). Realistic risk is therefore highest for Matomo deployments that are internet-facing AND permit self-registration or grant low-trust users site-management capabilities; locked-down single-admin instances are substantially less exposed.

This is a moderate-severity SSRF (CWE-918) in Matomo 5.11.2 rated CVSS 5.0. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N indicates a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L), with a changed scope (S:C) but only limited confidentiality impact and no integrity or availability impact. SSVC aligns with this moderate picture: exploitation status is 'poc' (not active), automatable is 'no', and technical impact is 'partial' - meaning this is useful to a targeted attacker but not a mass-exploitation candidate. A public proof-of-concept exists (GitHub SLO-CYBER-SEC/CVE-2026-78850, corroborated by SSVC 'poc'), so weaponization effort is reduced, but there is NO CISA KEV listing and NO EPSS score was provided, so real-world exploitation probability cannot be quantified from the input. The signals are internally consistent - nothing contradicts the authenticated, information-disclosure-only reading. Net: a real but second-tier priority. It warrants patching on a normal cycle for internet-exposed Matomo instances, especially those allowing untrusted or low-trust user accounts, rather than emergency out-of-band response. Note the affected-version metadata is unreliable (CPE and EUVD both read 'n/a'), and no vendor security advisory was located in the references, so scope of affected versions is unconfirmed.

An attacker with a low-privilege authenticated Matomo account (PR:L) sends a crafted request to the SiteContentDetector/SitesManager component, coercing the server to issue outbound requests to attacker-chosen URLs. Because scope is changed, the attacker can reach internal network resources or metadata endpoints normally shielded from the internet and read limited sensitive responses. A public proof-of-concept is available, lowering the skill required to reproduce the attack.