Which versions of Aptabase are affected by CVE-2026-63080?

Aptabase analytics instances prior to commit 5a89368 contain a cross-tenant data disclosure vulnerability in the stats API that allows one tenant to access other organizations' event data through SQL…

Is there a public PoC exploit available for CVE-2026-63080?

Yes, a public proof-of-concept exploit is available for CVE-2026-63080. Prioritise patching immediately. EPSS: 0.2%.

Aptabase CVE-2026-63080

Q: What is the CVSS score of CVE-2026-63080?

CVE-2026-63080 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: How to fix or mitigate CVE-2026-63080?

Within 24 hours: identify all Aptabase installations running versions prior to commit 5a89368 and audit which organizations' event data is accessible to each tenant. Within 7 days: implement access controls restricting the stats API endpoints to authorized users only and disable or constrain the vulnerable filter parameters (EventName, CountryCode, OsName, DeviceModel, AppVersion, SessionId) until a patched version is available. Within 30 days: conduct a forensic audit of API access logs for unauthorized cross-tenant queries, notify affected organizations of potential exposure, and deploy either a corrected version or Web Application Firewall rules blocking UNION keyword injection in API parameters.

EUVD-2026-46431 HIGH

SQL Injection (CWE-89)

2026-07-21 VulnCheck

GHSA-8c62-2f67-357x

SQLi Aptabase

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable stats API with low-privilege tenant auth (PR:L) and low complexity; read-only cross-tenant leak gives C:H with no integrity or availability impact; scope kept unchanged as the same application enforces the bypassed filter.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:40 vuln.today

CVE Published

Jul 21, 2026 - 21:02 cve.org

HIGH 7.1

DescriptionCVE.org

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.

AnalysisAI

Cross-tenant data disclosure in Aptabase (open-source privacy-friendly analytics) up to commit 5a89368 lets an authenticated tenant read every other tenant's event data by abusing a ClickHouse SQL injection in the stats API. Filter parameters (EventName, CountryCode, OsName, DeviceModel, AppVersion, SessionId) are interpolated unsanitized into Liquid SQL templates, letting an attacker append a UNION ALL that defeats the app_id tenant-isolation filter on 13 of 15 stats endpoints. Publicly available exploit code exists and the issue was reported by VulnCheck; no active exploitation is confirmed (not in CISA KEV).

Technical ContextAI

Aptabase renders ClickHouse queries from Liquid SQL templates, a text-templating approach where user-controlled filter values are substituted directly into the query string rather than passed as bound parameters. Because the filter fields are concatenated into the SQL text, the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause applies: a value such as EventName can close the intended string literal and introduce attacker-controlled SQL. The tenant boundary in Aptabase is enforced logically by a WHERE app_id = <tenant> predicate; a UNION ALL sub-select does not inherit that predicate, so injected queries can read rows belonging to any app_id. The affected component per CPE is cpe:2.3:a:aptabase:aptabase (all versions through commit 5a89368), and the vulnerable surface is the ClickHouse query backend serving the stats API.

RemediationAI

No vendor-released fixed version number is identified in the provided data; the fix is described relative to commit 5a89368, so upgrade to a build newer than that commit once the maintainers publish it and monitor the Aptabase repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/aptabase-sql-injection-via-clickhouse-query-backend) for the patched revision. Until a patched build is deployed, the durable fix is to convert the Liquid SQL templates to parameterized/bound ClickHouse queries or to strictly allowlist-validate the EventName, CountryCode, OsName, DeviceModel, AppVersion, and SessionId filter values (reject characters that can break out of a string literal, such as quotes, semicolons, and the UNION keyword). As compensating controls, restrict access to the stats API endpoints to trusted accounts and apply per-tenant network or WAF rules that block SQL meta-characters and UNION patterns in filter parameters, accepting that aggressive WAF filtering may reject legitimate event names containing quotes; on single-tenant deployments the cross-tenant impact is inherently reduced, so isolating tenants into separate ClickHouse databases/instances is an effective architectural mitigation at the cost of operational overhead.