Auth bypass in Open-Web-Analytics
CVE-2026-86810
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely. Upgrading to version 1.10.0 is sufficient to resolve this issue. The patch is named 6fc91c49eebdb8bfdfeed71cb50a5d97eac70f24. It is advisable to upgrade the affected component.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.008 (57.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Open-Web-Analytics — versions 1.9.0, 1.9.1
Weakness classification (CWE)
References
- github.com/Open-Web-Analytics/Open-Web-Analytics/ (product)
- github.com/Open-Web-Analytics/Open-Web-Analytics/commit/6fc91c49eebdb8bfdfeed71… (patch)
- github.com/Open-Web-Analytics/Open-Web-Analytics/issues/959 (issue-tracking)
- github.com/Open-Web-Analytics/Open-Web-Analytics/pull/961 (issue-tracking, patch)
- github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.10.0 (patch)
- vuldb.com/cve/CVE-2026-86810 (third-party-advisory)
- vuldb.com/submit/911107 (third-party-advisory)
- vuldb.com/vuln/399814 (technical-description, vdb-entry)
- vuldb.com/vuln/399814/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-86810?
- CVE-2026-86810 is a high-severity vulnerability in Open-Web-Analytics, classified under Improper Authentication. CVSS score: 7.3/10. Published 2026-09-08.
- How severe is CVE-2026-86810?
- High severity. CVSS v3 base score is 7.3 out of 10.