Live › vulnerability › CVE-2026-111670
Go to dashboardClickVisual through 1.1.2 has a missing authorization check in its /api/v2/reports handlers. An authenticated low-privileged user can change the instance-id parameter to enumerate schemas and infer row counts of ClickHouse tables they were never granted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running ClickVisual 1.1.2 or earlier that have more than one user with a low-privilege role. Exposure depends on whether those users are supposed to be limited to specific ClickHouse instances. Single-user installs or deployments where every account can see all instances are less exposed.
No product ranges from the sources yet.
1.1.2 are listed as affectedUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
This page as .md · .json · in your agent: get_signal("CVE-2026-111670")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.