EUVD-2026-102961
GHSA-92qp-c535-v34g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged ClickVisual user
-
ExploitIterate instance-id parameter in report handlers
-
ExecutionServer skips authorization re-check
-
ImpactEnumerate restricted schemas and infer table row counts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated ClickVisual account with low privileges (PR:L) - it is NOT reachable by unauthenticated anonymous users. Once logged in, the attacker simply increments or substitutes the 'instance-id' parameter in the ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun operations of the /api/v2/reports module; the handlers fail to verify that the caller was granted the referenced ClickHouse instance (CWE-862). No special non-default configuration or user interaction is needed. Limiting factors: the account prerequisite, and that disclosure is confined to schema metadata and inferred row counts rather than full record contents (VC:L, no integrity/availability impact). |
| Impact | This is a genuine but modest-severity information-disclosure issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly reflects a remotely reachable, low-complexity flaw that nonetheless REQUIRES an authenticated low-privileged account (PR:L), and the impact is limited to confidentiality only (VC:L; VI:N/VA:N) - attackers learn schema names and can infer row counts of restricted ClickHouse tables, but cannot read full row data, modify, or disrupt. All exploitation signals point the same direction (low real risk): no CISA KEV listing, no EPSS score supplied in the input, and no exploit-code flag was provided - only VulnCheck's advisory and a HackMD technical writeup. There is no SSVC decision data in the input. The signals are internally consistent: the authorization gap is real and easy to trigger once authenticated, but the bounded confidentiality-only impact and the need for valid credentials keep this a medium (5.3) issue suited to routine patching rather than crisis response. EPSS is absent, so widespread-exploitation probability cannot be quantified from the provided data. |
| Exploit ScenarioDerived | A low-privileged ClickVisual user who was granted access to only one ClickHouse instance alters the instance-id parameter on the report endpoints to reference instances they were never authorized for. Because the /api/v2/reports handlers do not re-check authorization, the server returns database, table, and column metadata for the restricted instance, and the user infers approximate row counts of sensitive tables. No exploit code is flagged in the input, but VulnCheck's advisory and a public HackMD writeup describe the technique in detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Authenticated, low-privileged users of ClickVisual through 1.1.2 can reach ClickHouse instances they were never granted by substituting or incrementing the instance-id parameter in the /api/v2/reports handlers (ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun). The handlers in api/internal/api/apiv2/report/report.go fail to confirm that the caller holds a grant on the referenced ClickHouse instance (CWE-862), so any logged-in account can enumerate database and table schemas and infer row counts of restricted tables; the issue is rated 5.3 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation requires a valid low-privileged account (it is not reachable anonymously), needs no special configuration or user interaction, and is limited to metadata disclosure rather than table contents - no public exploit identified at time of analysis, though a public technical writeup of the flaw is referenced by the CVE.
RemediationAI
No vendor-released patch or fixed version is identified in the available data - 'through 1.1.2' marks the confirmed vulnerable range rather than a released fix - so treat this as requiring compensating controls until upstream guidance appears. The most effective immediate mitigation is to add an authorization gate in front of the report module: either patch the handlers so that each request verifies the authenticated user holds a grant on the instance-id being referenced (the correct fix, applied at report.go and metadata.go), or, without code changes, place a reverse proxy or API gateway rule in front of ClickVisual that blocks /api/v2/reports and its ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun paths for all but a small, explicitly trusted group. That workaround breaks reporting for ordinary users, so it should be scoped by role or path rather than applied globally if reporting is a core workflow. Reduce the attack surface by auditing which accounts really need to reach the API at all - the flaw requires only a low-privileged login, so stale or broadly shared accounts should be disabled - and by reviewing ClickVisual's ClickHouse service credentials so that a single connection cannot span all instances. As a detection measure, alert on sequential or high-volume instance-id values in requests to the report endpoints, which is the signature of enumeration. Monitor https://www.vulncheck.com/advisories/clickvisual-through-1.1.2-missing-authorization-in-apiv2-report-module and the project repository for a patched release, and re-test the report endpoints with a low-privileged account after upgrading to confirm the cross-instance access is closed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClickVisual is an open-source ClickHouse log/observability platform whose Go API exposes a versioned REST surface under /api/v2. Its report module was designed to build reporting queries against one or more registered ClickHouse datasources, identified by an instance-id parameter that is passed from the client through handlers in api/internal/api/apiv2/report/report.go (lines 282-343) into the metadata service in api/internal/service/report/metadata.go (lines 136-152). The service performs the requested metadata lookups but never re-validates that the authenticated principal has been granted access to the instance identified by instance-id, which is the classic CWE-862 (Missing Authorization) pattern and manifests as a cross-instance IDOR. Because ClickHouse's own permission model is bypassed by ClickVisual's service account connection, the enumeration happens at the application layer: an attacker walks instance-id values to list databases, tables, and columns, and to run the WhereCheckRun operation, which leaks approximate row counts for restricted tables. CPE coverage (cpe:2.3:a:clickvisual:clickvisual:*:*:*:*:*:*:*:*) is a wildcard with no version bounds, so the advisory language 'through 1.1.2' should be treated as the confirmed tested boundary rather than a hard upper limit. The exposure is confidentiality-only and low in magnitude - schema structure and cardinality inference, no record contents, no writes, no denial of service - which aligns with the assessed VC:L/I:N/A:N vector.
Know when Clickvisual gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote over the API with low complexity, but a valid low-privileged account is required so PR:L; impact is confidentiality-only and partial (schema/row-count leakage), hence C:L, I:N, A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB