Description
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.
Published: 2026-07-21
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Aptabase contains a SQL injection flaw in the ClickHouse query backend that permits authenticated attackers to inject malicious parameters into Liquid SQL templates, enabling them to read event data from all tenants.

Affected Systems

The vulnerability exists in any Aptabase deployment that includes commit 5a89368; no specific version numbers are provided in the advisory.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers who are authenticated can supply malicious values in the EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters, injecting a UNION ALL statement into the Liquid SQL templates and bypassing the app_id tenant isolation filter across thirteen of the fifteen statistics API endpoints.

Generated by OpenCVE AI on July 30, 2026 at 16:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest Aptabase release that includes a fix for the ClickHouse query injection vulnerability (or apply the patch that removes unsanitized filter parameters from the Liquid SQL templates).
  • Restrict or disable the affected statistics API endpoints until a patch is applied to prevent authenticated attackers from attempting injections.
  • Implement server‑side input validation or parameter binding so that all query parameters are properly sanitized, mitigating similar injection attempts in the future.

Generated by OpenCVE AI on July 30, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Aptabase
Aptabase aptabase
Vendors & Products Aptabase
Aptabase aptabase

Wed, 22 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.
Title Aptabase SQL Injection via ClickHouse query backend
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aptabase Aptabase
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-22T18:24:56.728Z

Reserved: 2026-07-15T15:45:44.600Z

Link: CVE-2026-63080

cve-icon Vulnrichment

Updated: 2026-07-22T18:17:30.321Z

cve-icon NVD

Status : Deferred

Published: 2026-07-21T21:16:52.567

Modified: 2026-07-23T15:24:59.880

Link: CVE-2026-63080

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:30:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')