TI-2026-83120 Aliases CVE-2026-119646 GHSA-39w6-qc54-g7cg

Open Web Analytics REST report API exposes other sites' report data

MEDIUM 57CWE-639Published 2026-10-30 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Open Web Analytics before 1.14.1 does not restrict clickstream and transaction reports in its REST report API to the siteId the user is authorized for (CWE-639). An authenticated user with view_reports on one site can supply another site's siteId with a session_id or order_id to read that site's visit history, IP addresses, user agents and order data.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00458 39th percentileScored 2026-11-07

Fix Fixed Open Web Analytics (Open Web Analytics): 1.14.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Open Web Analytics	Open Web Analytics	before 1.14.1	1.14.1	Patch available	CNA

Open Web Analytics VendorOpen Web Analytics Affected before 1.14.1 Fixed in 1.14.1 Patch available CNA

Remediation

Upgrade Open Web Analytics to version 1.14.1, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA Open Web Analytics (Open Web Analytics) Fixed in 1.14.1

Timeline

2026-10-30 Threatist record created from CVE-2026-119646
2026-10-30 Alias added: GHSA-39w6-qc54-g7cg
2026-10-30 CISA SSVC decision points changed
2026-10-30 Priority changed: LOW → MEDIUM

References

Patch 2

Advisory 1

https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor

Other 4

TI-2022-08467 Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain… CVSS 3.1CRITICAL 9.8
TI-2025-36952 Open Web Analytics (OWA) before 1.8.1 allows owa_db.php v[value] SQL injection. CVSS 3.1MEDIUM 5.0
TI-2014-01820 Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object… CVSS 3.0CRITICAL 9.8
TI-2014-01122 Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which… CVSS 3.0HIGH 8.8
TI-2014-00920 SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before… CVSS 2.0HIGH 7.5
TI-2010-02567 PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA)… CVSS 2.0MEDIUM 5.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences