Is CVE-2026-112070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112070 being exploited in the wild.

How severe is CVE-2026-112070?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Typo3 Analytics extension 1.1.0 and below.

Is there a fix for CVE-2026-112070?

Yes: fixed in 1.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112070 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112070?

Check whether you run Typo3 Analytics extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112070: TYPO3 Analytics extension access control bypass in AJAX routes

CVE-2026-112070 · Severity: info · Published 2026-10-20

The Analytics extension for TYPO3, a PHP-based content management system, fails to verify that backend users have permission to access analytics data before serving it via AJAX requests. An authenticated backend user with access to any site can retrieve analytics data from other sites they should not have access to, potentially exposing sensitive business metrics and visitor information.

Vendors: Typo3.

Quick answers

Is CVE-2026-112070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112070 being exploited in the wild.
How severe is CVE-2026-112070?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Typo3 Analytics extension 1.1.0 and below.
Is there a fix for CVE-2026-112070?: Yes: fixed in 1.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112070 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112070?: Check whether you run Typo3 Analytics extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.1.1

Technical details

The extension's AJAX routes do not enforce backend user access control checks on module or dashboard widget permissions. An authenticated backend user with page access to one site can directly query AJAX endpoints to retrieve analytics data from other sites in the system. This is a broken access control vulnerability (CWE-862) exploitable via network access by any authenticated backend user without elevated privileges.

Affected products

TYPO3 Analytics extension 1.1.0 and below

Timeline

2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.