CVE-2026-116818

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.

CVSS 4.0

8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

CWE

CWE-89

Published

2026-10-26

Modified

2026-10-26

Record from

the CVE List, synced 2026-10-26

Affected

• openpanel-dev:openpanel

References

• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-8wr9-x797-f238
• https://github.com/Openpanel-dev/openpanel/commit/35ddc8ebbcd4ed0767933de61f014f153d68442a
• https://www.vulncheck.com/advisories/openpanel-before-3.0.0-unauthenticated-clickhouse-sql-injection-via-live-visitors-websocket

Check your stackJSON