PT-2026-116069 · Clickvisual · Clickvisual
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Clickvisual