Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-63080Aptabase SQL Injection via ClickHouse query backend

Medium 6.5

In plain English

A medium-severity SQL injection in aptabase from aptabase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.

Affected products (as reported)

Vendor	Product	Versions
aptabase	aptabase	0 – through 5a8936852a20c26267ffaefd3544f91e3ca94135

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/aptabase-sql-injection-via-clickhouse-query-backend third-party-advisory