CVE-2026-110621 Details
Description
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
A missing authorization vulnerability has been identified in Swetrix Cloud versions prior to 5.1.0. The issue resides in the ProjectController.addProject method, where authenticated users can hijack projects by transferring them to their own organization. Attackers can create an organization and use a victim's public tracking ID to add the project, gaining access to its analytics, settings, or the ability to delete it.
Users are advised to upgrade to Swetrix Cloud version 5.1.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts#L888-L920 | [email protected] | Source CodeVendor |
| https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588 | [email protected] | Source CodeVendor |
| https://github.com/Swetrix/swetrix/issues/477 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/Swetrix/swetrix/releases/tag/v5.1.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organisation-orgid | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Swetrix | >= 0, < 5.1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |