CVE-2026-116813

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 3.0.0

Description An issue exists in the getConversion() function of the ConversionService where unescaped event names and dates allow for the injection of ClickHouse SQL. Users with project-read permissions or those holding share links can manipulate string literals in series names or the startDate and endDate variables. By using techniques such as OR 1=1, an attacker can bypass project id scoping to access analytics data belonging to other tenants.

Recommendations Update to version 3.0.0 or later. As a temporary mitigation, restrict access to the getConversion() function for users with project-read permissions or share-link access.