CVE-2026-78850

Published: Oct 15, 2026Modified: Oct 26, 2026

5.0

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Exploitability: 3.1 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (7)

https://github.com/SLO-CYBER-SEC/CVE-2026-78850

Source: cve@mitre.org

https://github.com/matomo-org/matomo

Source: cve@mitre.org

https://github.com/matomo-org/matomo/pull/24834

Source: cve@mitre.org

https://github.com/matomo-org/matomo/security/advisories

Source: cve@mitre.org

https://github.com/matomo-org/matomo/tree/5.11.2

Source: cve@mitre.org

https://matomo.org/

Source: cve@mitre.org

https://github.com/SLO-CYBER-SEC/CVE-2026-78850

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.