CVE-2026-116807 in OpenPanel
Summary
by MITRE • 10/27/2026
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides in OpenPanel versions prior to 3.0.0, specifically within the mechanism that handles profile filtering for tenant-scoped data retrieval. This vulnerability is classified as an SQL injection, which corresponds to CWE-89 in the Common Weakness Enumeration standard. The core technical issue stems from insufficient input validation and sanitization of user-supplied filter names before they are incorporated into a database query structure. Specifically, when authenticated users request events filtered by profile criteria, the application constructs a JOIN subquery that includes these filter parameters directly without proper escaping or parameterized queries. This lack of robust encoding allows an attacker to manipulate the SQL syntax intended for filtering purposes.
The operational impact of this vulnerability is significant due to its potential to bypass tenant isolation controls, which are critical in multi-tenant SaaS environments. By injecting a crafted string containing a trailing comment sequence into the profile filter name parameter, an attacker can effectively terminate the original WHERE clause that restricts data access to specific project IDs. This technique neutralizes the security boundary designed to ensure that users only see events associated with their authorized projects. Consequently, this allows for unauthorized cross-tenant data exfiltration, where a user from one tenant or project can read sensitive event logs and operational data belonging to other tenants or unrelated projects within the same system instance.
From an offensive perspective, this exploitation aligns with ATT&CK technique T1078, which covers Valid Accounts, as it requires initial authentication but leverages those credentials for privilege escalation in terms of data access scope rather than administrative control. It also relates to T1530, Data from Cloud Storage Object or Database, specifically the aspect of reading unsecured cloud storage objects or database contents that are not properly segmented. The ability to bypass tenant scoping represents a severe breach of confidentiality and integrity principles, potentially exposing proprietary business logic, customer data, or internal operational metrics depending on what is stored in the event logs.
Mitigation strategies must prioritize immediate patching to version 3.0.0 or later where this flaw has been addressed by developers through proper input sanitization and the implementation of parameterized queries for all database interactions involving user-supplied filters. In addition to software updates, organizations should enforce strict input validation on the server side, ensuring that filter names are checked against a whitelist of allowed characters if possible. Database access controls should also be reviewed to ensure that even if SQL injection occurs at the application layer, least-privilege principles limit the database user's ability to execute arbitrary queries or bypass row-level security policies. Regular code audits focusing on dynamic query construction and penetration testing targeting multi-tenant isolation mechanisms are recommended to prevent similar vulnerabilities in future releases.