the analytics filter builder that fails has an SQL injection flaw

Published September 10, 2026 CVE-2026-88890

OpenPanel can let an authenticated user read analytics and profile information belonging to other organizations. The affected code reaches through commit cd24bb8.

Severity
HighCVSS 3.1 · 8.5
Fix
Not confirmedLast checked today
Affected versions
through cd24bb8
Weakness
CWE-89SQL Injection
Exploit likelihood
0.29% in 30 daysEPSS, higher than 21% of known flaws
Affects
OpenPanel
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75440ENISA vulnerability database

How it works

  • An authenticated user sends an analytics filter naming a profile field.
  • OpenPanel places that field into a ClickHouse query without safely checking it.
  • The user can inject additional query logic through that field.
  • This can bypass project separation and reveal other organizations' analytics and profile information.

What to do

Compare your deployed OpenPanel source commit with cd24bb8. Code at or before cd24bb8 falls within the affected range.

Review the OpenPanel security advisory and apply its remediation guidance. The supplied guidance supports allowlisting profile columns or escaping identifiers before they enter ClickHouse queries.

Technical details

CVE-2026-88890 is an SQL injection flaw in OpenPanel's analytics filter builder. An authenticated caller with project-scoped read or root export credentials can inject ClickHouse query logic, bypass project isolation, and read other organizations' analytics and profile PII.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L Open in FIRST.org calculator

References

View Original Source