CVE-2026-116813

MediumCVSS 6.5/10Last modified Oct 27, 2026

Description

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2026
Last modified: Oct 27, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1168146.5OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standa CVE-2026-1168154.3OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break C CVE-2026-1168167.8llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corr CVE-2026-1168176.5OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashbo CVE-2026-1168188.2OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through CVE-2026-1168198.5OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integrati CVE-2026-116828.3Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the re CVE-2026-1168205.3YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL CVE-2026-1168216.5YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns wit CVE-2026-1168225.3YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary t CVE-2026-1168236.1YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by s CVE-2026-1168246.1YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated a