Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110621: Swetrix Cloud lets users take over other projects

CVE-2026-110621 · published 1 day ago

Summary

Swetrix Cloud versions before 5.1.0 allow a logged‑in user to move any project into an organization they control. This lets the attacker view the project's analytics, change its settings, or delete it. Update Swetrix Cloud to version 5.1.0 or later to stop this behavior.

What to do

Update swetrix swetrix to version 5.1.0 or later.

Affected software

Vendor	Product	Affected versions
swetrix	swetrix	< 5.1.0

Original advisory text

Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.

References

https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff5... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1106... Vendor Advisory
https://github.com/Swetrix/swetrix Product
https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/pr... Third Party Advisory
https://github.com/Swetrix/swetrix/issues/477 Third Party Advisory
https://github.com/Swetrix/swetrix/releases/tag/v5.1.0 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-110621 Vendor Advisory
https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authoriz... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published14 Oct 2026

Updated15 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-110621 · NVD

CVE-2026-110621 · MITRE

CVE-2026-110621 · OSV

Track software like this

Free during beta