Description
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TYPO3 | Extension "Analytics" | < 1.1.1 | 1.1.1 |
Advisories 1
- WID-SEC-2026-4053 TYPO3 Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-031 vendor-advisory