# CVE-2026-119646: Open Web Analytics authorization bypass in report data access

Source: https://junglewise.ai/threats/cve-2026-119646-open-web-analytics-before-1-14-1-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119646 · Severity: medium · CVSS 4.3 · Published 2026-10-30

Open Web Analytics is a web analytics platform that tracks visitor behavior and transactions on websites. This vulnerability allows attackers who have legitimate access to view reports on one website to read sensitive data—including visit history, IP addresses, and order information—from completely different websites by manipulating request parameters. An attacker could steal competitor analytics, customer data, or transaction records without proper authorization.

Technologies: [Open-Web-Analytics](https://junglewise.ai/threats/technologies/open-web-analytics). Vendors: [Open-Web-Analytics](https://junglewise.ai/threats/vendors/open-web-analytics).

## Quick answers

**Is CVE-2026-119646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119646 being exploited in the wild.

**How severe is CVE-2026-119646?** Medium severity, with a CVSS score of 4.3, published 30 October 2026.

**Which products and versions are affected?** Open-Web-Analytics before 1.14.1.

**Is there a fix for CVE-2026-119646?** Yes: fixed in 1.14.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119646 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119646?** Check whether you run Open-Web-Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.14.1

## Technical details

The vulnerability is an authorization bypass in the ReportsRest API controller where clickstream and transaction report endpoints fail to properly validate that the requested siteId matches the user's authorized scope. An authenticated attacker with view_reports permission on Site A can access Site B's data by supplying Site A's siteId along with Site B's session_id or order_id, bypassing siteId scoping checks. The flaw affects report data retrieval across the analytics platform.

## Affected products

- Open Web Analytics Open Web Analytics before 1.14.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/Open-Web-Analytics/Open-Web-Analytics](https://github.com/Open-Web-Analytics/Open-Web-Analytics)
- [https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Base/Controller/ReportsRest.php](https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Base/Controller/ReportsRest.php)

## Related threats

- [Open-Web-Analytics unsafe deserialization in Remote Event Queue](https://junglewise.ai/threats/cve-2026-97865-a-security-flaw-has-been-discovered-in-open-web-analytics-up-to-1)
- [Open-Web-Analytics improper authentication in Controller](https://junglewise.ai/threats/cve-2026-86810-open-web-analytics-improper-authentication-in-controller)