OpenPanel CVE-2026-116812

Requires an authenticated OpenPanel account with at least project-read access to any project (PR:L); no write or admin role is needed. The attacker invokes the tRPC cohort.preview query (protectedProcedure, guarded only by READ on the top-level projectId) and supplies a cohort property filter whose 'name' field - which is a free-form z.string() with no allowlist - contains SQL in column-identifier context; using operator isNotNull with an empty value array even removes the need for a filter value. The deployment must use the ClickHouse analytics backend (the default) in a multi-tenant configuration for the cross-tenant read to have value. Limiting factors: a valid low-privileged account is mandatory (not exploitable pre-authentication), and the impact is confined to reading data, not modifying it. The affected sink (profileColumnAccess) is distinct from the separately-fixed profileColumnSql, which already enforces the PROFILE_COLUMNS allowlist.

This is a genuine but access-gated data-disclosure issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree: exploitation is network-reachable and low-complexity but requires an authenticated account - specifically a project-read member - so PR:L is confirmed, not inferred. Impact is confidentiality-only (VC:H, VI:N/VA:N): a cross-tenant ClickHouse read, with no integrity or availability effect. EPSS is low (0.23%, 14th percentile) and there is no CISA KEV listing, consistent with a flaw that needs valid credentials and crafted tooling rather than one seeing opportunistic mass exploitation. The vuln.today decision label is 'this_week', reflecting a real-but-not-critical priority. A detailed proof-of-concept filter is published in the GitHub Security Advisory, lowering the practical bar for a would-be attacker who already holds project-read access. One conflict must be flagged: the intelligence feed states 'Patch: Available from vendor' and EUVD implies a fix in 3.0.0, yet the GHSA source evidence explicitly says the fix is 'unreleased' / 'not yet patched' on HEAD - verify fix availability with the vendor before relying on an update.

An attacker who holds (or obtains) a project-read membership on a multi-tenant OpenPanel instance calls the tRPC cohort.preview endpoint and submits a cohort filter whose column-name field contains an injected correlated subquery. Because the column identifier is spliced unescaped into argMax/cityHash64/comparison clauses and the subquery is not constrained by the outer project_id scope, the attacker reads another tenant's ClickHouse data. A public PoC reference exists in the GHSA advisory (an isNotNull filter with an embedded SELECT); it is not verified as working exploit code.