CVE-2026-119646

Dashboard / Vulnerabilities / CVE-2026-119646

CVE-2026-119646

Published: 30 Oct 2026Last Modified: 1 Nov 2026

Summary: Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

Details: Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119646.json, https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.14.1, https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor, https://nvd.nist.gov/vuln/detail/CVE-2026-119646, https://www.vulncheck.com/advisories/open-web-analytics-before-1.14.1-cross-site-data-disclosure-via-rest-report-api, https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/1236, https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/9a1b62893fe8242048a1129d96f89a52f910be72, https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/e6832fa60ead473c5792a999ae32abb3fecc2790, https://github.com/Open-Web-Analytics/Open-Web-Analytics, https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Base/Controller/ReportsRest.php#L466-L618

Affected packages

Package

Name:

Purl:

Affected ranges

Type: GIT

Events:

Introduced- 0

Fixed -cf4e0d067e986fd9c6bcf38ebf8c7c8e6b6f6556

Affected versions

1.8.2

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High