Executive brief
OpenPanel is an open-source product analytics platform that stores and analyzes user event data. A SQL injection vulnerability in the analytics query filter builder allows authenticated users with project credentials to inject malicious SQL commands, bypassing the per-organization data isolation controls and reading other organizations' analytics data and customer personally identifiable information (emails, names, properties). The flaw affects the profile.* filter validation, which fails to sanitize column identifiers before inserting them into ClickHouse SQL queries.
Technical details
The vulnerability is a column-identifier-position SQL injection (CWE-89, CWE-943) in the filter-where.service.ts module, specifically in the profileColumnSql() function. The function fails to validate or escape profile.* filter identifiers before interpolating them directly into ClickHouse WHERE clauses; sibling validation functions (groupColumnSql, sessionColumnSql) correctly use allowlists, but profileColumnSql returns the raw unvalidated identifier. An authenticated attacker with project-scoped read or root export credentials can craft a malicious profile.* filter that escapes the application-layer project_id scoping predicate, enabling blind boolean/time-oracle SQL injection across tenant boundaries. The attack is network-accessible and requires only valid API credentials; no user interaction is needed. Patches are not yet available as of the advisory publication.
Affected products
- Openpanel-dev OpenPanel through commit cd24bb8
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-hwf2-2v2h-7892 published
- 2026-09-10: advisory: NVD entry CVE-2026-88890 published