rootpwn

medium · CVSS v3 5 · CVSS v4 5.3

CVE-2026-93983

OpenPanel through commit bad75bdd fails to properly escape property keys in ClickHouse SQL queries. This vulnerability allows authenticated

Overview

OpenPanel through commit bad75bdd fails to properly escape property keys in ClickHouse SQL queries. This vulnerability allows authenticated users to inject boolean SQL terms via crafted filter names. Consequently, attackers can bypass project isolation mechanisms to access metrics belonging to other projects.

Description

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

Impact

This issue compromises confidentiality by enabling unauthorized cross-project data access within the application. Authenticated users with access to filtering features are impacted, as they can leverage the vulnerability to view sensitive metrics from other projects. Integrity and availability are not directly impacted by this specific flaw.

Remediation

Apply the latest vendor patch or update OpenPanel beyond commit bad75bdd. Ensure all property keys utilized in ClickHouse SQL queries are properly parameterized or escaped before execution. Review access controls and audit query generation logic to prevent SQL injection patterns.

Risk context

Rated as a medium severity vulnerability with a CVSS v3 score of 5.0 and CVSS v4 score of 5.3, this issue requires authenticated access to exploit. EPSS data is currently unavailable. Remediation should be prioritized during standard maintenance cycles to maintain proper tenant isolation.

Affected products

  • OpenPanel

Scores

Severity
medium
CVSS v2
4
CVSS v3
5
CVSS v4
5.3
EPSS
—

SQL Injection OpenPanel ClickHouse Tenant Isolation Access Control Medium Severity

← All CVEs

Related CVEs

medium

CVE-2026-89333

The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 4.0.8. The flaw exists due to missing validation on the 'student_id' parameter. This allows authenticated attackers with subscriber-level access to harvest sensitive user information, including emails and phone numbers, by iterating through user IDs.

View analysis

medium

CVE-2026-89334

An authorization bypass vulnerability exists in the Better Messages WordPress plugin up to version 2.15.33 due to improper privilege verification. The flaw allows authenticated users with custom-level access or higher to read unauthorized chat transcripts, thread metadata, and user data. This occurs when specific default chat room settings remain unconfigured.

View analysis

medium

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before version 28.2 fails to validate conversation ownership during unauthenticated AI booking-assistant actions. This flaw allows unauthenticated visitors to read and inject messages into other users' active conversations. It matters because it exposes private communications within the scheduling interface.

View analysis

medium

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 allows unauthenticated users to publish arbitrary GraphQL queries and claim aliases without authorization. This flaw lets attackers inject or modify persisted queries that the site’s frontend will later execute. It can lead to data leakage, query tampering, or denial of service.

View analysis