CVE-2026-116818

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116806

OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116819

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116814

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116810

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116817

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116812

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116808

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116815

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116811

OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116807

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116813

OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116809

OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-116805

OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-88893

OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-88892

OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/safe-fetch.ts). In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch() on config.fileUrl, which is validated only by z.string().url(), so values such as http://127.0.0.1:9911/ or http://169.254.169.254/latest/meta-data/ are accepted; the shared createFileImportConfig factory gives the plausible provider the same field. An authenticated organization member — including a default 'member' with no project_access rows, for whom the intended access-level check is skipped because getProjectAccess returns boolean true rather than a level object — can therefore make the server connect to any address reachable from it. The resulting HTTP status and status text are persisted as Import.errorMessage and returned by import.get to the same user, providing a scanning oracle for internal hosts, ports and paths; if an internal response parses as Umami CSV, its rows are ingested as events and become readable in the attacker's analytics views.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-88891

OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-88890

OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-85615

Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-85614

OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel