CVE-2026-88890 — OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating t…
Published: 2026-09-10 · CVSS: 8.4 · CVSS 4.0
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7