Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-88890OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier

High 8.5

In plain English

A high-severity SQL injection in openpanel from Openpanel-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.

Affected products (as reported)

Vendor	Product	Versions
Openpanel-dev	openpanel	0 – through 2.3.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

References

GitHub Security Advisory (GHSA-hwf2-2v2h-7892) vendor-advisory
VulnCheck Advisory: OpenPanel SQL Injection via unvalidated profile filter column identifier third-party-advisory