Aptabase
Monthly
Cross-tenant data disclosure in Aptabase (open-source privacy-friendly analytics) up to commit 5a89368 lets an authenticated tenant read every other tenant's event data by abusing a ClickHouse SQL injection in the stats API. Filter parameters (EventName, CountryCode, OsName, DeviceModel, AppVersion, SessionId) are interpolated unsanitized into Liquid SQL templates, letting an attacker append a UNION ALL that defeats the app_id tenant-isolation filter on 13 of 15 stats endpoints. Publicly available exploit code exists and the issue was reported by VulnCheck; no active exploitation is confirmed (not in CISA KEV).
Cross-tenant data disclosure in Aptabase (open-source privacy-friendly analytics) up to commit 5a89368 lets an authenticated tenant read every other tenant's event data by abusing a ClickHouse SQL injection in the stats API. Filter parameters (EventName, CountryCode, OsName, DeviceModel, AppVersion, SessionId) are interpolated unsanitized into Liquid SQL templates, letting an attacker append a UNION ALL that defeats the app_id tenant-isolation filter on 13 of 15 stats endpoints. Publicly available exploit code exists and the issue was reported by VulnCheck; no active exploitation is confirmed (not in CISA KEV).