CVE-2026-111670 — ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse inst…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7