Vulnerability in TYPO3 Extension "Analytics"

[ Description ]Official description

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4053

  TYPO3 Extensions: Multiple vulnerabilities Translated from German

  CVE-2026-113468CVE-2026-112239CVE-2026-112068+12 more CVEs

[ References ]References

• typo3.org/security/advisory/typo3-ext-sa-2026-031