{"id":"CVE-2026-78850","aliases":["DEBIAN-CVE-2026-78850","EUVD-2026-102185","GHSA-rw9v-xch6-cr33","UBUNTU-CVE-2026-78850"],"status":"disputed","title":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the...","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00332,"percentile":0.26794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2026-10-15T00:00:00Z","modified":"2026-10-28T20:15:22Z","exploits":[{"source":"pocgithub","id":"SLO-CYBER-SEC/CVE-2026-78850","title":"SLO-CYBER-SEC/CVE-2026-78850","date":"2026-07-04","url":"https://github.com/SLO-CYBER-SEC/CVE-2026-78850"}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"matomo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.1+dfsg-1","5.5.1+dfsg-1","5.5.1+dfsg-2","5.5.1+dfsg-3","5.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matomo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.1+dfsg-3","5.8.0-1","5.8.0-1ubuntu1","5.8.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matomo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.1+dfsg-1","5.5.1+dfsg-1","5.5.1+dfsg-3"]}],"references":[{"url":"https://github.com/matomo-org/matomo","tags":["report"]},{"url":"https://github.com/matomo-org/matomo/tree/5.11.2","tags":["report"]},{"url":"https://github.com/matomo-org/matomo/security/advisories","tags":["report"]},{"url":"https://matomo.org/","tags":["report"]},{"url":"https://github.com/SLO-CYBER-SEC/CVE-2026-78850","tags":["exploit","report"]},{"url":"https://github.com/matomo-org/matomo/pull/24834"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78850"},{"url":"https://matomo.org"},{"url":"https://github.com/advisories/GHSA-rw9v-xch6-cr33"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-78850","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-78850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78850","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-78850","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.","status":"disputed","published":"2026-10-15T00:00:00Z","modified":"2026-10-26T13:00:40.358Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-102185","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-26T13:00:40Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:29.915597Z"}],"ghsa":[{"id":"GHSA-rw9v-xch6-cr33","title":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the...","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component","status":"published","published":"2026-10-15T18:32:44Z","modified":"2026-10-26T15:34:22Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:14:23.996006Z"}],"nvd":[{"id":"CVE-2026-78850","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.","status":"disputed","published":"2026-10-15T17:17:28.513Z","modified":"2026-10-26T14:16:40.48Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"DEBIAN-CVE-2026-78850","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.","status":"published","published":"2026-10-15T17:17:28.513Z","modified":"2026-10-27T09:47:41.124237918Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"UBUNTU-CVE-2026-78850","description":"An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.","status":"published","published":"2026-10-15T17:17:00Z","modified":"2026-10-28T20:15:22.891516186Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:18.015985Z"}]}}