Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck
CVE-2026-91198GrowthBook through 5.0.1 Information Disclosure via Public Endpoints
Medium 5.3
In plain English
A medium-severity security flaw in growthbook from growthbook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| growthbook | growthbook | 0 – through 5.0.1 |
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #6541 issue-tracking
- https://github.com/growthbook/growthbook product
- https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/services/reports.ts#L880-L890 technical-description
- https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/app.ts#L391-L409 technical-description
- VulnCheck Advisory: GrowthBook through 5.0.1 Information Disclosure via Public Endpoints third-party-advisory