ClickVisual versions up to 1.1.2 expose a missing authorization flaw in the /api/v2/reports handlers. Because the instance-id parameter is not properly checked, users with low privileges can retrieve information about ClickHouse instances, schemas, tables, and even infer row counts for restricted data. This allows an attacker to enumerate database metadata and potentially identify sensitive tables without proper authorization.

The affected vendor is ClickVisual and the product is ClickVisual, specifically deployments of version 1.1.2 or earlier. The flaw exists in the API layer that serves report-related endpoints.

The CVSS score of 5.3 indicates a moderate severity. Although EPSS data is not available, the misconduct requires only authenticated access and could be exploited by iterating instance IDs quickly. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread, publicly known exploitation has been reported to date. Attackers would most likely send crafted HTTP requests to the reportr endpoints, supplying a series of instance IDs to discover schema information. Because the flaw is in the authorization logic, it can be fully leveraged once an attacker obtains any user credentials with limited rights within the ClickVisual platform.