---
cve: "CVE-2026-78850"
severity: "MEDIUM"
cvss: 5.0
epss: "0.3%"
vendor: "n/a"
kev: false
exploited: false
published: "2026-10-15 00:00:00"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-05T18:10:28+01:00"
---

# CVE-2026-78850

> 5.0 MEDIUM · 🧪 PoC

## Beschreibung

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2026-10-26 13:00:40

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-918** — Server-Side Request Forgery
  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

## Angriffsmuster (CAPEC)

- [CAPEC-664 — Server Side Request Forgery](https://capec.mitre.org/data/definitions/664.html) _(Severity: High)_

## BSI-Hinweise (deutsch)

- [Matomo: Schwachstelle ermöglicht Offenlegung von Informationen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3990) — _BSI-Einstufung: mittel_
  Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Matomo ausnutzen, um Informationen offenzulegen.

## Referenzen

- <https://github.com/matomo-org/matomo>
- <https://github.com/matomo-org/matomo/tree/5.11.2>
- <https://github.com/matomo-org/matomo/security/advisories>
- <https://matomo.org/>
- <https://github.com/SLO-CYBER-SEC/CVE-2026-78850>
- <https://github.com/matomo-org/matomo/pull/24834>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-78850/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_