CVE-2026-86810

HighCVSS 7.3/10Last modified Sep 10, 2026

Description

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely. Upgrading to version 1.10.0 is sufficient to resolve this issue. The patch is named 6fc91c49eebdb8bfdfeed71cb50a5d97eac70f24. It is advisable to upgrade the affected component.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/aOpen-Web-Analytics1.9.0; 1.9.1

References

Timeline

Published
Sep 8, 2026
Last modified
Sep 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-868126.5The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permCVE-2026-868134.8The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notiCVE-2026-868148.1The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before CVE-2026-868155.5The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination,CVE-2026-868165.3The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers toCVE-2026-868174.9The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema fielCVE-2026-868184.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. CVE-2026-868197.1Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clientsCVE-2026-86824.3The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versiCVE-2026-868235.3The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription actionCVE-2026-868244.8The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its trackinCVE-2026-868265.9The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, a
CVE-2026-86810: High severity, CVSS 7.3 | Vulnix