CVE-2026-119646

MEDIUM 4.3

Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

CWE	CWE-639
Vendor	open web analytics
Product	open web analytics
Published	Oct 30, 2026
Last Updated	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for open web analytics open web analytics

Be the first to know when new medium vulnerabilities affecting open web analytics open web analytics are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Open Web Analytics / Open Web Analytics

0 < 1.14.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/1236 github.com: https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/9a1b62893fe8242048a1129d96f89a52f910be72 github.com: https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/e6832fa60ead473c5792a999ae32abb3fecc2790 github.com: https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.14.1 github.com: https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Base/Controller/ReportsRest.php#L466-L618 hackmd.io: https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor github.com: https://github.com/Open-Web-Analytics/Open-Web-Analytics vulncheck.com: https://www.vulncheck.com/advisories/open-web-analytics-before-1.14.1-cross-site-data-disclosure-via-rest-report-api

Credits

hieuPenguinnn padams