Live › vulnerability › CVE-2026-116808
Go to dashboardOpenPanel before 3.0.0 passes the property parameter of profile.values into SQL without proper escaping. An authenticated user can inject a SELECT with their own FROM and WHERE clauses, comment out the project_id scope, and read profiles, events and sessions from other projects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
OpenPanel installations before 3.0.0 where multiple tenants or projects share one instance and users hold accounts that can call profile.values. Single-tenant deployments where every account belongs to the same trust group have less exposure, but the sources do not say how much. Teams on 3.0.0 or later can skip it.
No product ranges from the sources yet.
3.0.0 or later is not affected by this entry.3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116808")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.