Executive brief
GrowthBook is an open-source platform for feature flags, experimentation, and product analytics. A vulnerability in versions through 5.0.1 exposes sensitive data warehouse schema and SQL queries through unauthenticated API endpoints. Attackers who know a public report or experiment ID can read internal SQL queries, table structures, filter values, and data source credentials, potentially revealing business logic and enabling follow-up database attacks.
Technical details
GrowthBook returns unredacted fact table definitions and raw warehouse SQL in API responses from unauthenticated public report and experiment endpoints. The vulnerability stems from insufficient output filtering of sensitive metadata that should not be exposed in public-facing API payloads. An attacker with knowledge of a publicly shared report or experiment identifier can access internal data warehouse query text, schema information, table names, filter values, and datasource identifiers without authentication. The exposure is limited to information already associated with public reports/experiments, but the SQL and schema details disclosed could facilitate reconnaissance for database attacks or reveal confidential business logic.
Affected products
- GrowthBook GrowthBook through 5.0.1
Timeline
- 2026-09-14: disclosed