CVE-2026-116818

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 3.0.0

Description An unauthenticated SQL injection issue exists in the ClickHouse database integration. Remote attackers can inject SQL via the projectId parameter of the /live/visitors/:projectId WebSocket endpoint, which fails to perform session and project-access validation. This allows the use of UNION or boolean count oracles to access events and profiles belonging to other tenants. Additionally, project members can perform similar injections using the cohort.preview timeframe values.

Recommendations Update to version 3.0.0 or later. Restrict access to the /live/visitors/:projectId WebSocket endpoint as a temporary mitigation.