---
id: "CVE-2026-116807"
kind: "vulnerability"
aliases: ["CVE-2026-116807"]
title: "OpenPanel: SQL injection in profile filters lets users read other projects' events"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["analytics", "multi-tenant", "openpanel", "package", "self-hosted"]
not_affected_if: ["no-untrusted-users", "patched-version", "single-project"]
published_at: "2026-10-27T00:17:13+00:00"
first_seen_at: "2026-10-27T00:25:55+00:00"
updated_at: "2026-10-27T00:26:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116807", "first_seen_at": "2026-10-27T00:25:55+00:00"}]
---

# OpenPanel: SQL injection in profile filters lets users read other projects' events

OpenPanel before 3.0.0 does not escape profile filter names placed into a JOIN subquery, so a crafted filter name with a trailing comment can break out of the project_id restriction. An authenticated user can read events belonging to every project on the instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenPanel version; versions below `3.0.0` are affected.
- unknown

## Fix

- Upgrade OpenPanel to `3.0.0` or later.
- unknown

## Timeline

- 2026-10-27T00:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116807

## From the sources

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_