EUVD-2026-75440
GHSA-6vg6-383g-xj2w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires low-privilege credentials (PR:L); scope change (S:C) reflects cross-tenant PII exfiltration; no integrity impact; minimal availability impact from oracle query load.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.
AnalysisAI
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated profile.* filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authentication is required: the attacker must possess valid project-scoped read credentials or root export credentials for at least one project on the target OpenPanel instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L, score 8.4) accurately characterizes the threat: network-accessible, low complexity, requiring only project-level credentials, with a confirmed scope change that captures the cross-tenant isolation bypass. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade OpenPanel to a commit after cd24bb8; the exact patched release version should be confirmed via the vendor advisory at https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-hwf2-2v2h-7892, as a precise tagged release version is not confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify OpenPanel deployments in production, confirm if analytics filter features are active, and notify affected customers and data protection officers of potential cross-tenant data exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated h
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated m
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the m
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's brow
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP re
Cross-tenant broken object level authorization (BOLA) in OpenPanel before 2.3.0 exposes confidential report definitions
Cross-tenant insecure direct object reference in Openpanel before 2.3.0 allows authenticated users to read or reset othe
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today