The vulnerability is an Insecure Direct Object Reference that allows any backend user who can access the analytics module to view the analytics dashboard of any site, regardless of whether they have explicit site permissions. This flaw enables unauthorized disclosure of site activity data, compromising confidentiality of the site’s operational insights. The weakness falls under CWE-639, indicating improper authorization controls.

The affected product is the TYPO3 extension "Analytics". All installations that include this extension are potentially impacted; no specific version information is provided, so any version prior to the official fix is considered at risk.

The CVSS score of 5.3 reflects a moderate impact, and the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation recorded. Attackers would need to authenticate as a backend user and navigate to the analytics module, implying the attack vector is through an authenticated web session. Once accessed, the attacker can retrieve information about other sites within the TYPO3 instance.