CVE-2026-112068Medium· 5.3▾ SunlitThe backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
t3g/analytics < 1.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112070Medium· 5.3Broken Access Control in extension "Analytics" (analytics)
CVE-2026-112240Medium· 6.3Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
CVE-2026-56093Medium· 6.3The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path
CVE-2026-77127Medium· 6.0Information Disclosure in extension "Modules" (modules)
CVE-2026-112069Medium· 6.3Broken Access Control in extension "FAL Protect" (fal_protect)
CVE-2026-113468Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)