CVE-2026-97865

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/Open-Web-Analytics/Open-Web-Analytics/
https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/78c1222ec0e2119d84684032da1541120a2cdd23
https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/960
https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/967
https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.8.2
https://vuldb.com/cve/CVE-2026-97865
https://vuldb.com/submit/911108
https://vuldb.com/vuln/409882
https://vuldb.com/vuln/409882/cti

Configurations

No configuration.

History

25 Sep 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-25 14:17

Updated : 2026-09-28 15:16

NVD link : CVE-2026-97865

Mitre link : CVE-2026-97865

CVE.ORG link : CVE-2026-97865

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-97865", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97865", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T13:45:08.444276Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:open-web-analytics:open-web-analytics:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Remote Event Queue Endpoint"], "product": "Open-Web-Analytics", "versions": [{"status": "affected", "version": "1.8.0"}, {"status": "affected", "version": "1.8.1"}, {"status": "unaffected", "version": "1.8.2"}]}]}], "published": "2026-09-25T14:17:27.423", "references": [{"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/", "source": "cna@vuldb.com"}, {"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/78c1222ec0e2119d84684032da1541120a2cdd23", "source": "cna@vuldb.com"}, {"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/960", "source": "cna@vuldb.com"}, {"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/pull/967", "source": "cna@vuldb.com"}, {"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.8.2", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-97865", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/911108", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/409882", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/409882/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The affected component should be upgraded."}], "lastModified": "2026-09-28T15:16:04.793", "sourceIdentifier": "cna@vuldb.com"}