high8.2
CVE-2026-116818
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId para…
Impact
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
Affected products
| Product | Affected versions |
|---|---|
| OpenPanel | before 3.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Openpanel-dev/openpanel/commit/35ddc8ebbcd4ed0767933de61f014f153d68442a
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-8wr9-x797-f238
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-unauthenticated-clickhouse-sql-injection-via-live-visitors-websocket