CVE-2026-110621

8.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-862

Impact

Authenticated attackers can hijack arbitrary projects into their own organization using only the project's public tracking ID. This grants full control to view analytics, modify settings, or delete victim projects.

Root cause

The ProjectController.addProject endpoint lacks authorization checks when reassigning existing projects to a different organization.

Affected systems

Swetrix Cloud before 5.1.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Swetrix Cloud to version 5.1.0 or later. If upgrading immediately is not possible, block or restrict POST requests to the /project/:organisationId endpoint via a reverse proxy or WAF.

shell

$ git fetch --tags && git checkout v5.1.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110621