The Analytics extension for TYPO3 fails to perform proper access checks on its AJAX routes, so any authenticated backend user can send requests to the extension’s endpoints and receive analytic data for any site they have content editing permissions for. This flaw results in an unauthorized data‑exposure vulnerability classified as a CWE‑862 access‑control error. The impact is that confidential site metrics can leak to users outside the intended audience, potentially revealing business‑critical insights.

The affected product is the TYPO3 extension named Analytics. No specific version range is indicated, which means that any deployed instance using a version released before the vendor’s patch could be vulnerable. TYPO3 installations that incorporate the extension without upgrading to the corrected build are at risk.

The CVSS v3 score of 5.3 indicates moderate severity, while the EPSS probability of less than 1% suggests a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, which further reduces the perceived risk of widespread attacks. Based on the description, the likely attack vector is an authenticated usage scenario – the attacker must first be a legitimate backend user. From that foothold, exploitation is trivial: simply navigate to the exposed AJAX endpoint, and the extension will return analytics data for any site the user can edit. Consequently, while the overall risk is moderate, the vulnerability remains exploitable by any active TYPO3 backend account until mitigated.