CVE-2026-57230

MediumCVSS 5.4/10Last modified Jul 13, 2026

Description

OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2026
Last modified: Jul 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-572317.5Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with j CVE-2026-572323.1Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configure CVE-2026-572338.1Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to un CVE-2026-572342.6Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri t CVE-2026-572358.2Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias CVE-2026-572368.2Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an inval CVE-2026-572377.8When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects refere CVE-2026-572387.8After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, whi CVE-2026-572397.8The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the oppor CVE-2026-57246.3The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are CVE-2026-572407.8When the application opens a PDF file and JavaScript deletes the PDF fields, the subsequent logic still uses the old field pointers, resulti CVE-2026-572416.1The application opens the PDF, and JavaScript performs operations on the page and the document, causing the page-related objects within the