CVE Feed

    Dashboard / CVE / CVE-2026-119646

    CVE-2026-119646

    Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

    Published:Oct 30, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 30, 2026
    EPSS Score:
    CVSS Score:4.3

    Affected Products

    Vendor
    Openwebanalytics
    Product
    Open Web Analytics

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-59397 (CVSS 5) — Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection.…
    CVE-2022-24637 (CVSS 9.8) — Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user infor…
    CVE-2014-2294 (CVSS 9.8) — Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a cr…
    CVE-2014-1457 (CVSS 8.8) — Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remo…
    CVE-2014-1456 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows rem…
    CVE-2014-1206 (CVSS 7.5) — SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote …
    CVE-2010-2677 (CVSS 5.1) — PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_…
    CVE-2010-2676 (CVSS 5) — Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote…

    References

    https://github.com/Open-Web-Analytics/Open-Web-Analytics
    https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Base/Controller/ReportsRest.php#L466-L618
    https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/9a1b62893fe8242048a1129d96f89a52f910be72
    https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/e6832fa60ead473c5792a999ae32abb3fecc2790
    https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/1236
    https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.14.1
    https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor
    https://www.vulncheck.com/advisories/open-web-analytics-before-1.14.1-cross-site-data-disclosure-via-rest-report-api
    https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High