{"id":"CVE-2026-116813","published":"2026-10-27T00:17:14.853","lastModified":"2026-10-27T00:17:15.097","description":"OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7fm7-rprq-g8rm","tags":[]},{"url":"https://www.vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-conversion-service-ts","tags":[]}],"exploitRefs":[{"url":"https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7fm7-rprq-g8rm","tags":[]}],"hasPoc":true,"ai":null}