CVE-2026-119646 Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119646?
CVE-2026-119646 is a medium-severity vulnerability in Open Web Analytics, published on 30 Oct 2026.
Official description
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.
Weakness: CWE-639
Which versions are affected by CVE-2026-119646?
How do I fix CVE-2026-119646?
No fix has been published for CVE-2026-119646 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119646 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119646 exists.
Sources
Also known as GHSA-39w6-qc54-g7cg.