Live › vulnerability › CVE-2026-116807
Go to dashboardOpenPanel before 3.0.0 does not escape profile filter names placed into a JOIN subquery, so a crafted filter name with a trailing comment can break out of the project_id restriction. An authenticated user can read events belonging to every project on the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted OpenPanel instances running a version before where more than one tenant or project shares the same database. An attacker needs a valid user account on the instance. Instances running a patched release, or with only one project, have less to lose.
3.0.0No product ranges from the sources yet.
3.0.0 are affected.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.
This page as .md · .json · in your agent: get_signal("CVE-2026-116807")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.