Extension Analytics
Monthly
Authorization bypass in the TYPO3 'analytics' backend module lets any authenticated backend user who has module access open the analytics dashboard of any site in a multi-site installation, exposing read-only analytics data across site boundaries (CWE-639). The issue is a moderate IDOR-class flaw scored CVSS 4.0 5.3 and assessed at CVSS 3.1 5.3 with PR:L, and there is no public exploit identified at time of analysis. Single-site installations see no additional disclosure because there is only one site to view.
Authenticated TYPO3 backend users can retrieve analytics data for sites they have page access to because the analytics extension's AJAX routes do not verify access to the related backend module or dashboard widget. This affects TYPO3 installations where the analytics extension is installed and active; exploitation requires valid backend credentials, and no public exploit code or active exploitation was identified at time of analysis, keeping risk low-to-moderate.
Authorization bypass in the TYPO3 'analytics' backend module lets any authenticated backend user who has module access open the analytics dashboard of any site in a multi-site installation, exposing read-only analytics data across site boundaries (CWE-639). The issue is a moderate IDOR-class flaw scored CVSS 4.0 5.3 and assessed at CVSS 3.1 5.3 with PR:L, and there is no public exploit identified at time of analysis. Single-site installations see no additional disclosure because there is only one site to view.
Authenticated TYPO3 backend users can retrieve analytics data for sites they have page access to because the analytics extension's AJAX routes do not verify access to the related backend module or dashboard widget. This affects TYPO3 installations where the analytics extension is installed and active; exploitation requires valid backend credentials, and no public exploit code or active exploitation was identified at time of analysis, keeping risk low-to-moderate.