CVE-2026-116813OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

Beschreibung

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-7fm7-rprq-g8rm) vendor-advisory
• VulnCheck Advisory: OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts third-party-advisory