Open Web Analytics versions earlier than 1.14.1 contain an authorization flaw that permits an authenticated user to retrieve report data belonging to other sites. Because clickstream and transaction reports are not appropriately scoped, an attacker who has the view_reports privilege for one site can supply a session_id or order_id from a different site and read that site’s visit history, IP addresses, user agents and order information. This vulnerability is related to CWE‑639, which describes unauthorized information disclosure. The impact is the leakage of sensitive user and transaction data, but it does not provide code execution or direct modification of the system.

The affected product is Open Web Analytics, any deployment running a version earlier than 1.14.1. The vulnerability exists in the ReportsRest module, which is part of the Core repository up to release 1.14.0. Users of older releases should verify their current version against the change log for version 1.14.1, which contains the fixed logic.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated and have the view_reports role on any site that is not the target of the data disclosure. Once the attacker supplies a target session_id or order_id from another site, the API will return the full report data. The vulnerability is therefore an authorization issue that allows cross‑site data exposure without affecting system integrity or availability, but it could still cause significant privacy and compliance concerns.