HIGH 7.0 NVD
CVE-2026-116807
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter na
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.
References
- https://github.com/Openpanel-dev/openpanel/commit/a2aa053cb23e92967e812d3be5fb0f1d606d9fdc
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-pc3q-gw7f-p2x2
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-e
This high severity vulnerability with a CVSS score of 7.0 was published on 2026-10-27 via NVD.
vulnfeed aggregates 18513 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.