CVE-2026-116818
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values.
타임라인
- NVD 공개
- 첫 보도 데일리시큐 · 오픈패널 고위험 취약점 공개, 로그인 없이 다른 고객의 분석정…
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L