EUVD-2026-78207
GHSA-gv2h-crgm-gfwc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication required per PR:N; confidentiality impact is low because only SQL/schema metadata is disclosed, not warehouse data; no integrity or availability impact applies.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.
AnalysisAI
GrowthBook through version 5.0.1 leaks raw warehouse SQL queries, schema details, table names, filter values, and datasource identifiers via unauthenticated public report and experiment endpoints. Any party who obtains a publicly shared report or experiment identifier can retrieve these internal data warehouse details without authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a GrowthBook user has intentionally used the platform's public sharing feature to share a report or experiment, generating an accessible public identifier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with AV:N/AC:L/PR:N/UI:N and VC:L reflects a straightforwardly network-reachable, unauthenticated disclosure path, but practical risk is gated on whether an organization has enabled public report or experiment sharing - an intentional user action rather than a default-open configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade GrowthBook to a version beyond 5.0.1 once a patched release is published; monitor GitHub issue #6541 and the repository at github.com/growthbook/growthbook for a tagged release that redacts warehouse SQL and schema fields from public endpoint serialization, as no specific fixed version number is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today