{"id":"CVE-2026-116813","kind":"vulnerability","aliases":["CVE-2026-116813"],"related":[],"title":"OpenPanel: SQL injection lets members read other tenants' analytics data","description":"OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.","summary":"OpenPanel before 3.0.0 builds ClickHouse queries in ConversionService.getConversion from unescaped event names and dates. An attacker with project-read access or a share link can break out of string literals and read other projects' analytics.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analytics","clickhouse","openpanel","package","self-hosted"],"not_affected_if":["upgraded-to-3.0.0"],"how_to_check":"- Check the OpenPanel version in use; `unknown` whether the sources give a deployment check beyond the version.\n- Look for share links in use: unknown whether the sources list a specific setting.","fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Rotate any public share links until upgraded: unknown whether the sources name a specific link-revocation step.","status":"open","published_at":"2026-10-27T00:17:14+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:23+00:00","updated_at":"2026-10-27T00:26:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenPanel to `3.0.0` or later.\n- Rotate any public share links until upgraded: unknown whether the sources name a specific link-revocation step.","reach":"network","title":"OpenPanel: SQL injection lets members read other tenants' analytics data","impact":"medium","summary":"OpenPanel before 3.0.0 builds ClickHouse queries in ConversionService.getConversion from unescaped event names and dates. An attacker with project-read access or a share link can break out of string literals and read other projects' analytics.","category":"package","nicknames":[],"who_cares":["openpanel","self-hosted","clickhouse","analytics"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads other tenants' analytics data via injected ClickHouse SQL.","analyst_note":"Confirm the exact fixed version and any workaround in the NVD entry or OpenPanel advisory; the sources give no check command.","how_to_check":"- Check the OpenPanel version in use; `unknown` whether the sources give a deployment check beyond the version.\n- Look for share links in use: unknown whether the sources list a specific setting.","needs_analyst":true,"not_affected_if":["upgraded-to-3.0.0"],"who_is_affected":"Self-hosted or hosted OpenPanel installations running a version before `3.0.0`. Exposure requires a project-read member or a share-link holder, so instances with no shared access carry less risk, but the affected code path is the conversion query, which the sources do not say is reachable only through share links.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3347,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116813':13A,16A '-2026':12A,15A '1':106C,107C '3.0.0':26B,62C 'access':44B 'allow':71C 'analyt':9A,17B,59B,117C 'attack':39B,91C 'break':50B,93C 'build':27B 'clickhous':18B,28B,83C 'contain':63C 'conversionservice.getconversion':31B,69C 'cve':11A,14A 'data':10A,118C 'date':37B,90C 'event':34B,87C 'holder':80C 'host':23B 'id':111C 'inject':3A,66C,82C 'let':4A 'link':48B,79C 'liter':54B,97C 'member':5A,75C 'name':35B,88C,100C 'neutral':109C 'openpanel':1A,19B,24B,60C 'packag':20B 'project':42B,58B,73C,110C 'project-read':41B,72C 'queri':29B 'read':6A,43B,56B,74C,114C 'scope':112C 'self':22B 'self-host':21B 'seri':99C 'share':47B,78C 'share-link':77C 'sql':2A,65C,84C 'startdate/enddate':102C 'string':53B,96C 'tenant':8A,116C 'unescap':33B,86C 'valu':103C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or hosted OpenPanel installations running a version before `3.0.0`. Exposure requires a project-read member or a share-link holder, so instances with no shared access carry less risk, but the affected code path is the conversion query, which the sources do not say is reachable only through share links.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116813","severity":null,"published_at":"2026-10-27T00:17:14+00:00","modified_at":"2026-10-27T00:17:15+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}