medium · CVSS v3 6.5 · CVSS v4 5.3 · EPSS 0.00351

CVE-2026-112070

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widge…

Description

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

Scores

Severity
medium
CVSS v2
4
CVSS v3
6.5
CVSS v4
5.3
EPSS
0.00351

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-86940

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory.

View analysis

medium

CVE-2026-86953

An out‑of‑bounds write flaw in Apple’s operating systems was patched in version 27. The vulnerability could allow a nearby attacker to trigger a denial‑of‑service by corrupting memory. It affects all current iOS, iPadOS, macOS, tvOS, visionOS, and watchOS releases.

View analysis

medium

CVE-2026-86955

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.

View analysis