Read the docs
TI-2026-74115 Aliases CVE-2026-110621GHSA-88cr-32hr-63rh

Missing authorization in Swetrix Cloud lets users hijack projects

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Swetrix Cloud before 5.1.0 contains a missing authorization flaw in ProjectController.addProject (CWE-862). An authenticated user with low privileges can move any project into their own organisation by its public tracking ID. The attacker can then read analytics, change settings, or delete the project.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed swetrix (Swetrix): 5.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Swetrixswetrixbefore 5.1.05.1.0Patch availableCNA
  • swetrix VendorSwetrix Affected before 5.1.0 Fixed in 5.1.0 Patch available CNA

Remediation

Update Swetrix Cloud to version 5.1.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA swetrix (Swetrix) Fixed in 5.1.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110621
  2. 2026-10-14 Alias added: GHSA-88cr-32hr-63rh
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-20 CISA SSVC decision points changed
  5. 2026-10-20 Priority changed: LOW → MEDIUM
  6. 2026-11-06 Affected versions changed · Red Hat
  7. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 3

  • TI-2025-36878 A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences