Vulnerability Description
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Open-Web-Analytics/Open-Web-Analytics
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Bas
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/9a1b62893fe82420
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/e6832fa60ead473c
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/1236
- https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.14.1
- https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor
- https://www.vulncheck.com/advisories/open-web-analytics-before-1.14.1-cross-site
- https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor
FAQ
What is CVE-2026-119646?
CVE-2026-119646 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to ...
How severe is CVE-2026-119646?
CVE-2026-119646 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119646?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.