OpenPanel CVE-2026-116813

Exploitation requires an authenticated low-privilege actor: either a project-read member (who controls the series[].name field) or a share-link holder (who controls startDate/endDate), reaching the vulnerable path via the tRPC chart.conversion endpoint (chart.ts:547, chartProcedure). No non-default configuration is needed - the flaw is in the default conversion-query code path, where event names and dates are interpolated raw into ClickHouse SQL while projectId is sqlstring.escape()d. The cross-tenant read specifically depends on the shared ClickHouse reader credential being able to read all rows, so that neutralizing project_id scope exposes other tenants. LIMITING FACTORS: the attacker must already possess at least read-level project access or a valid share link (PR:L, not unauthenticated), the deployment must be multi-tenant for cross-tenant impact to be meaningful, and only confidentiality is affected (no write/integrity or availability impact).

Signals are consistent in pointing to a real but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) and score of 7.1 describe a network-reachable, low-complexity flaw requiring low privileges, with high confidentiality impact and no integrity or availability impact - matching the described cross-tenant analytics read. EPSS is low (0.23%, 14th percentile) and the CISA SSVC signals are benign (Exploitation: none, Automatable: no, Technical Impact: partial), and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A detailed public PoC reference exists in the GHSA advisory (including a concrete injection payload), but it is not verified as a working, weaponized exploit tool, and PoC availability is distinct from active exploitation. The vuln.today 'this_week' decision label reflects a genuine authenticated cross-tenant data-breach vector that warrants prompt remediation, but the authentication requirement (PR:L - a project-read member or share-link holder) and SSVC 'Automatable: no' make opportunistic mass exploitation unlikely. CONFLICT TO VERIFY: input metadata states 'Patch: Available from vendor' and the NVD/EUVD data imply a fix in 3.0.0, yet the GHSA source-code advisory explicitly states the fix is 'unreleased'/'not yet patched' and the code is vulnerable on HEAD - confirm fixed-version availability directly with the vendor before relying on an upgrade.

An attacker who holds low-privilege project-read access (or a valid share link) to an OpenPanel instance submits a conversion chart whose event series name - e.g. x' OR 1=1 OR events.name = 'y - breaks out of the single-quoted ClickHouse string literal, or alternatively sets a non-YYYY-MM-DD startDate/endDate that is interpolated verbatim. Because the ClickHouse reader credential reads all rows, the OR 1=1 neutralizes the project_id tenant scope and returns other organizations' analytics and event data. A concrete PoC payload is published in the GHSA advisory, though it is not verified as a packaged working exploit.