TYPO3 Analytics EUVD-2026-104871

Requires an authenticated TYPO3 backend user who has been granted access to the analytics backend module; the flaw is the absence of a per-site access check, so the user can request the analytics dashboard of any site in the installation. Meaningful impact is limited to multi-site TYPO3 installations where backend users are expected to be restricted to specific sites; in single-site installs there is nothing additional to disclose. Limiting factors: valid backend credentials with module access are mandatory (PR:L), exploitation is confined to analytics dashboard viewing (read-only), and no unauthenticated or anonymous path exists.

This is a moderate, authorization-bypass (IDOR, CWE-639) issue in the TYPO3 'analytics' extension, not a high-priority emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and 5.3 score indicate a network-reachable, low-complexity flaw that nonetheless requires an authenticated backend user with access to the module (PR:L), which substantially limits the attacker population to existing editors/operators rather than anonymous internet attackers. No EPSS score, no CISA KEV listing, and no POC reference were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation would be targeted/insider rather than widespread. One internal inconsistency to verify: the vendor vector claims integrity impact (VI:L), but the description describes only viewing another site's analytics dashboard - a read-only disclosure - which implies the integrity rating may be overstated (confidentiality-only impact is more consistent with the text). Overall this reads as a genuine but low-to-moderate multi-tenant data-segregation weakness, not a critical-but-hyped issue.

An authenticated TYPO3 backend user who has been granted access to the analytics module - but who should only see their own site - manipulates the site/dashboard request to load the analytics dashboard of a different site in the same installation. This yields unauthorized visibility into another site's traffic/analytics data in a multi-site TYPO3 deployment. No public exploit code was provided, and exploitation is low-complexity but requires an existing authenticated backend account.