CVE-2026-110621

Executive Summary

CVE-2026-110621 is a missing authorization vulnerability (CWE-862) in the ProjectController.addProject method of Swetrix Cloud prior to version 5.1.0. An authenticated attacker can create an organization and add an arbitrary victim project into it by supplying the project's public tracking ID, thereby gaining control over that project's analytics, settings, and deletion capability. With a CVSS 3.1 base score of 8.8 (High) and no public exploit or vendor patch evidence in tracked sources, any internet-exposed Swetrix Cloud instance below 5.1.0 is at risk.

Technical Analysis

The vulnerability class is CWE-862 (Missing Authorization), specifically a Broken Object/Function Level Authorization failure. Swetrix Cloud is the hosted analytics platform for the open-source Swetrix web-analytics product; ProjectController.addProject is the controller action responsible for attaching a project to the caller's organization.

The flaw is an authorization gap rather than an input-validation or memory-safety defect. addProject fails to verify that the requesting user is a legitimate member/owner of the project identified in the request, or that the project is not already bound to another organization. Because the only identifier required to reference a project is its public tracking ID — a value that is by design embedded in client-side tracking snippets on victim websites and therefore inherently discoverable — the authorization check that should tie the project to the caller's organization is absent or insufficient.

Consequences derived strictly from the NVD description:

• A project belonging to another organization can be moved into the attacker's own organization by referencing its public tracking ID.
• Once moved, the attacker can read the project's analytics, change its settings, and delete it.
• The attacker requires only an authenticated account; no victim interaction (UI:N) and no elevated privileges (PR:L) are needed, while network reachability (AV:N) with low attack complexity (AC:L) keeps exploitation practical.

The high confidentiality, integrity, and availability subscores (C:H/I:H/A:H) reflect that the attacker obtains full read access to analytics data, module write control over settings, and destructive ability. Scope is Unchanged (S:U) because the impact is confined to the Swetrix Cloud application and data plane rather than crossing an authorization boundary into the host OS or another security authority.

No code-level diff, function signature beyond ProjectController.addProject, or advisory detail is available in the supplied intelligence; the mechanism above is inferred from the vulnerability class and the NVD description. No public PoC, Nuclei template, or exploit code is available.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies Swetrix Cloud instances below version 5.1.0 (AFFECTED_VERSION: < 5.1.0) and collects victim public tracking IDs. These identifiers appear in the JavaScript tracking snippet embedded on monitored websites, so they are passively obtainable from any target site that uses Swetrix.

2. Triggering the flaw class. The attacker registers/authenticates to the Swetrix Cloud instance and creates their own organization. Using the ProjectController.addProject action, they submit a project reference built from the victim's public tracking ID. Because the missing authorization check does not confirm ownership or prior binding of the project, the action succeeds and moves the victim project under the attacker's organization.

3. Payload / execution method (class level). Exploitation is a normal authenticated request to the project-add controller action, not a memory-corruption payload. The "payload" is simply the victim's public tracking ID plus the attacker's organization context. No invented endpoints or parameters are asserted beyond ProjectController.addProject.

4. Post-exploitation impact. With the project now under attacker control, the attacker can read the victim's analytics data, modify project settings, and delete the project — resulting in data confidentiality loss, integrity tampering, and destruction/denial of the victim's analytics capability.

Impact Assessment

• Confidentiality (C:H): Full access to the hijacked project's analytics data.
• Integrity (I:H): Attacker can change project settings.
• Availability (A:H): Attacker can delete the project, permanently disrupting the victim's analytics.
• Attack prerequisites: Authenticated account (PR:L), network access (AV:N), low complexity (AC:L), no user interaction (UI:N).
• Scope: Unchanged (S:U); blast radius is bounded to the Swetrix Cloud tenant data plane.
• Blast radius: Every organization with a project on an affected Swetrix Cloud instance whose public tracking ID is exposed on an instrumented website.
• Business impact: Loss of proprietary web/product analytics, unauthorized data exposure, integrity tampering, and potential destruction of historical analytics data. Brand and compliance exposure follows from unauthorized access to and deletion of customer data.
• EPSS: Not yet scored by FIRST.org.
• CISA KEV: Not listed. No exploit-in-the-wild evidence in the supplied data.

Detection Guidance

Sigma Rule

title: Potential Swetrix Project Hijack via addProject Missing Authorization
id: 8f3c2b91-7d4e-4a2f-9c1b-3e5f6a7b8c9d
status: experimental
description: Detects authenticated requests to Swetrix ProjectController.addProject that may indicate cross-organization project hijacking (CVE-2026-110621).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110621
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_uri:
    cs-uri-stem|contains: 'addProject'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate project creation by authorized users
level: medium

YARA Rule

rule CVE_2026_110621_Swetrix_AddProject_Missing_Authz
{
    meta:
        description = "Detects references to Swetrix addProject authorization gap (CVE-2026-110621)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110621"
        date = "2026-01-01"
    strings:
        $a = "addProject" ascii wide nocase
        $b = "ProjectController" ascii wide nocase
        $c = "trackingId" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110621 Swetrix addProject missing authorization attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"addProject"; nocase; reference:cve,2026-110621; classtype:attempted-user; sid:2026110621; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "POST"]
  [http where http.request.method == "POST" and stringContains(http.request.body.text, "addProject")]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*addProject*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path
| where count > 0

Wazuh OSSEC Rule

<group name="web,swetrix,">
  <rule id="100621" level="10">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>addProject</url>
    <description>CVE-2026-110621: Potential Swetrix ProjectController.addProject project hijack attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict or disable the public organization-creation and project-add workflow for untrusted users, or require administrative approval before a project can be attached to an organization.
   • Add server-side authorization that verifies the caller owns or is a member of the project's existing organization before any project is moved, and reject requests that reference a project already bound to another organization.
   • Treat public tracking IDs as non-secret identifiers; never use them as the sole reference for privileged mutation operations.
   • Monitor and alert on addProject calls per the detection rules above.

2. Patch/upgrade steps

   • Upgrade Swetrix Cloud to version 5.1.0 or later (the fix version cited in the CVE description). No vendor patch source is confirmed in tracked data; validate the fix release before relying on it.
   • After upgrade, audit organizations for unexpected project bindings and restore hijacked projects.

3. Long-term hardening

   • Enforce object-level and function-level authorization checks (OWASP API1/API5) across all controllers, not just addProject.
   • Implement tenant-scoped access control so every mutation validates project-to-organization ownership.
   • Add regression tests for cross-organization project operations and periodic authorization review.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-110621
• MITRE CWE-862 (Missing Authorization) — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application) — https://attack.mitre.org/techniques/T1190/
• FIRST CVSS 3.1 Specification — https://www.first.org/cvss/v3.1/specification-document
• CISA KEV Catalog (not listed for this CVE) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog No known threat actor campaigns or exploit-in-the-wild evidence are available for this CVE in the supplied data.