CVE-2026-88890

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to commit cd24bb8

Description An SQL injection issue exists in the analytics filter builder due to insufficient validation of profile.* filter column identifiers before they are interpolated into ClickHouse WHERE clauses. An authenticated attacker possessing project-scoped read or root export credentials can execute arbitrary ClickHouse SQL. This allows the attacker to bypass project isolation and access analytics data and profile PII (Personally Identifiable Information) from other organizations using blind boolean oracle techniques, a method of extracting data by asking the database true/false questions based on the application's response.

Recommendations Update OpenPanel to a version including commit cd24bb8 or later.