OpenPanel EUVD-2026-75440

Authentication is required: the attacker must possess valid project-scoped read credentials or root export credentials for at least one project on the target OpenPanel instance. The vulnerable code path is the analytics filter builder API endpoint, triggered by supplying crafted profile.* filter column identifier parameters in requests. Exploitation requires the ability to send repeated HTTP requests and observe differential response behavior (boolean oracle), which is achievable with any standard HTTP client. Single-tenant deployments still expose full analytics data to any authenticated attacker but lack the cross-tenant PII risk. Deployments upgraded beyond commit cd24bb8 are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L, score 8.4) accurately characterizes the threat: network-accessible, low complexity, requiring only project-level credentials, with a confirmed scope change that captures the cross-tenant isolation bypass. The SC:H metric is the critical signal here - an attacker with one legitimate project account can reach data belonging to entirely separate organizations. Even a mid-sized municipal IT team in legnica running OpenPanel to host analytics for multiple departments should treat this as urgent given the PII exposure risk. No KEV listing and no public POC have been identified, which moderates the immediate exploitation pressure, but the low privilege threshold (any valid project-scoped read or root export credential) and the systematic nature of blind oracle exfiltration mean a motivated insider or compromised account poses a serious cross-tenant breach risk. EPSS data was not provided; exploitation probability must be inferred from the low-bar access requirements and the well-understood nature of boolean SQLi techniques.

An attacker with a legitimate project-scoped read account crafts analytics API requests containing malicious profile.* column identifier values with embedded ClickHouse SQL predicates. By iterating character values and observing differential true/false response patterns across repeated queries, they systematically reconstruct PII and analytics data belonging to other tenants without triggering explicit error messages. No public exploit code has been identified, but blind boolean SQLi is a well-documented, scripted technique requiring only standard HTTP tooling.