CVE-2026-116818

HighCVSS 8.2/10Last modified Nov 8, 2026

Description

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Openpanel-devopenpanel< 3.0.0

References

Timeline

Published
Oct 27, 2026
Last modified
Nov 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1168198.5OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integratiCVE-2026-116828.3Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the reCVE-2026-1168205.3YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQLCVE-2026-1168216.5YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns witCVE-2026-1168225.3YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary tCVE-2026-1168236.1YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by sCVE-2026-1168246.1YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated aCVE-2026-1168256.5YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header orCVE-2026-1168266.8YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated adCVE-2026-1168276.8YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows CVE-2026-1168284.9YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTECVE-2026-1168296.6llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor el
CVE-2026-116818: High severity, CVSS 8.2 | Vulnix