Description
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Analytics" | < 1.1.1 | 1.1.1 |
Advisories 1
- WID-SEC-2026-4053 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-031 vendor-advisory