Swetrix Cloud versions prior to 5.1.0 contain a missing authorization flaw in the ProjectController.addProject endpoint. The flaw allows any authenticated user to move projects—identified only by a public tracking ID—into an organisation that belongs to the attacker. By hijacking a project the attacker can read all associated analytics, alter configuration and, if desired, delete the project entirely.

The vulnerability affects Swetrix Cloud installations running any version earlier than 5.1.0, such as the 5.0.x releases identified by the advisory references. No specific sub‑versions beyond the major pre‑5.1.0 boundary are listed as affected.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is 0.00523 (<1%), and the issue is not listed in the CISA KEV catalog, indicating that no large‑scale public exploitation has been reported. However, because an attacker only requires a legitimate authenticated session, the exploit can be performed by any user who is logged into the service. The attack path involves sending a POST request to /project/organisation/:orgId with the target project’s public ID, after which the project becomes owned by the attacker's organisation, granting full control over it.