Executive brief
OpenReplay is a self-hosted session replay suite used by businesses to analyze user behavior on their websites. A security flaw in the Enterprise Edition's multi-tenancy feature allows an authorized user to perform unauthorized database queries. This could lead to the exposure of sensitive analytics data across different projects or cause the session search functionality to stop working for other users.
Technical details
An SQL injection vulnerability exists in the session search and analytics API of OpenReplay Enterprise Edition (multi-tenant configurations) prior to version 1.27.0. The application constructs ClickHouse queries by directly concatenating user-provided input into query strings without proper escaping in at least two locations. An authenticated attacker with low privileges can exploit this via network requests to perform blind boolean or time-based data exfiltration from any ClickHouse table. Additionally, malicious input can be stored, breaking the session search functionality for all project viewers. The issue is resolved in version 1.27.0 by implementing validation for numeric filter values.
Affected products
- OpenReplay OpenReplay Enterprise Edition < 1.27.0
Timeline
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-06-23: patched: Fix committed to main branch
- 2026-07-10: disclosed: CVE published to NVD