OpenPanel CVE-2026-116815

Requires an authenticated account that is a member of a project with at least read access - enforceAccess only requires 'read' for the chart.sankey query (PR:L). The attacker supplies a crafted events[].name value containing a backslash followed by a quote to the chart.sankey protectedProcedure, which flows unvalidated into the hand-rolled replace(/'/g, "''") escape in sankey.service.ts. Limiting factors: exploitation needs valid project membership (not remote-unauthenticated); impact is confined to breaking the Sankey chart endpoint for that one project (self-inflicted denial of a feature the attacker can already view); there is no confidentiality or integrity effect and no cross-tenant reach; and it is fixed in OpenPanel 3.0.0.

This is a genuine but low-impact availability flaw, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with impact limited to VA:L and VC:N/VI:N correctly captures the mechanism: an authenticated project member can break one chart endpoint, with no confidentiality or integrity impact. The reported score of 5.3 (medium) slightly overstates it - the reporting researcher (VulnCheck) explicitly rates it Low and demonstrates, with measured ClickHouse 24.8 tests, that the escaping defect cannot be escalated to SQL injection or cross-tenant reads because quote parity always leaves a dangling quote that forces a parse error. EPSS is low (0.23%, 14th percentile), consistent with a self-limiting denial of one feature rather than a widely attractive exploit. KEV status is not listed (treat as not actively exploited), and the vuln.today decision label is 'this_month' - a patch-in-routine-cycle priority, not act_now/emergency. The one signal worth stating plainly: the input Tags label this 'Information Disclosure', which directly contradicts the advisory - there is no disclosure, only availability loss of the Sankey chart. Bottom line: real, confirmed, but low urgency; prioritize on the normal monthly patch cycle.

An authenticated member of any project (read access suffices) submits a report definition to the chart.sankey tRPC procedure containing an events[].name value with a backslash-escaped quote (e.g. containing \'). The hand-rolled escape doubles quotes but not backslashes, so the ClickHouse string literal terminates early and the query fails to parse, returning Code: 62 syntax errors and disabling that project's Sankey chart endpoint. A public PoC reference exists in the GHSA advisory with measured payloads; it is verified as causing the parse-error denial but the researcher confirms it could not be turned into a working injection.