SZB-69409e0146
Open Web Analytics report scoping flaw exposes other sites' data, EUVD-2026-114062
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Open Web Analytics
- Product
- Open Web Analytics
- First seen
Summary
The EUVD record EUVD-2026-114062 describes an authorization vulnerability in Open Web Analytics before 1.14.1 with a CVSS v3.1 score of 5.3. It says authenticated users can read other sites' clickstream and transaction reports because they are not scoped to the authorized siteId.
If you use Open Web Analytics
Upgrade Open Web Analytics to 1.14.1 or later
Review user accounts with access to multiple sites
Check report access logs for cross-site queries
What the sources say 1
· Mastodon: “Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId.” Source