Clickvisual
Monthly
Authenticated, low-privileged users of ClickVisual through 1.1.2 can reach ClickHouse instances they were never granted by substituting or incrementing the instance-id parameter in the /api/v2/reports handlers (ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun). The handlers in api/internal/api/apiv2/report/report.go fail to confirm that the caller holds a grant on the referenced ClickHouse instance (CWE-862), so any logged-in account can enumerate database and table schemas and infer row counts of restricted tables; the issue is rated 5.3 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation requires a valid low-privileged account (it is not reachable anonymously), needs no special configuration or user interaction, and is limited to metadata disclosure rather than table contents - no public exploit identified at time of analysis, though a public technical writeup of the flaw is referenced by the CVE.
Authenticated, low-privileged users of ClickVisual through 1.1.2 can reach ClickHouse instances they were never granted by substituting or incrementing the instance-id parameter in the /api/v2/reports handlers (ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun). The handlers in api/internal/api/apiv2/report/report.go fail to confirm that the caller holds a grant on the referenced ClickHouse instance (CWE-862), so any logged-in account can enumerate database and table schemas and infer row counts of restricted tables; the issue is rated 5.3 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation requires a valid low-privileged account (it is not reachable anonymously), needs no special configuration or user interaction, and is limited to metadata disclosure rather than table contents - no public exploit identified at time of analysis, though a public technical writeup of the flaw is referenced by the CVE.