CVE-2026-116813 in OpenPanel
Summary
by MITRE • 10/27/2026
OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in OpenPanel versions prior to 3.0.0 represents a critical SQL injection flaw located within the ConversionService.getConversion method, which is responsible for processing conversion events and associated temporal parameters. This defect arises from insufficient input validation and sanitization of user-supplied data, specifically event names and date ranges such as startDate and endDate values. When these inputs are passed to the underlying ClickHouse database engine, they are concatenated directly into SQL query strings without proper escaping or parameterization. This architectural oversight allows malicious actors to manipulate the structure of the executed queries by injecting arbitrary SQL syntax that alters the intended logic of the data retrieval process.
The operational impact of this vulnerability is severe due to its potential for unauthorized access to sensitive analytics data across multi-tenant environments. By exploiting the lack of input sanitization, an attacker can break out of existing string literals within series names or date parameters using standard SQL injection techniques such as appending OR 1=1 conditions. This specific payload neutralizes the project_id scoping mechanism that is designed to isolate tenant data. Consequently, users who possess only read access permissions for a specific project, including those holding share-link credentials, can bypass these restrictions and query analytics data belonging to other tenants or projects within the same instance. This results in a complete failure of multi-tenancy isolation, leading to significant confidentiality breaches where proprietary business metrics, user behavior patterns, and financial conversion rates are exposed to unauthorized parties.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attack vector leverages the application's failure to properly validate or escape special characters that have meaning within the database query language. In terms of offensive security frameworks, this exploitation technique corresponds to ATT&CK tactic T1059 Command and Scripting Interpreter with sub-technique T1059.004 SQL Commands, as it involves injecting commands directly into a backend service via application input fields rather than through system-level command execution. The ability of share-link holders to exploit this flaw highlights the importance of strict permission boundaries and secure coding practices even for endpoints intended for limited or external access.
Mitigation strategies must prioritize immediate patching to version 3.0.0 or later, where these specific inputs are properly sanitized and parameterized. In addition to upgrading, developers should implement prepared statements with bound parameters for all database interactions involving user-supplied data to ensure that input is treated strictly as data rather than executable code. Input validation routines should be strengthened to enforce strict type checking and length constraints on event names and date fields, rejecting any inputs containing characters commonly used in SQL injection attacks such as single quotes, semicolons, or logical operators like OR and AND when they appear outside of expected formats. Furthermore, implementing a Web Application Firewall with rules specifically tuned for ClickHouse SQL syntax anomalies can provide an additional layer of defense against exploitation attempts while the application is being updated.