OpenPanel contains an SQL injection flaw in the analytics filter builder that occurs when profile.* column identifiers are not validated before being inserted into ClickHouse WHERE clauses. The vulnerability, identified in commit cd24bb8, permits attackers to inject arbitrary ClickHouse SQL. Because of this, an authenticated attacker who possesses project‑scoped read or root export credentials can bypass project isolation and extract confidential analytics data and profile PII through blind boolean oracle techniques. This is a classic instance of CWE‑89, where unsanitized input is used to craft malicious queries that the database executes.

The affected product is OpenPanel, developed by Openpanel‑dev. No specific released versions are listed; the issue is present in any deployment that includes commit cd24bb8 or earlier unpatched states of the analytics filter builder.

The CVSS score of 8.4 indicates high severity, and the vulnerability is not listed in CISA KEV. Although a current EPSS score is unavailable, the requirement for authenticated access with project‑scoped read or root export permissions suggests that the attack vector is limited to users who have legitimate credentials within the system. An attacker who gains such access can leverage the injection to execute arbitrary ClickHouse statements, read across organizational boundaries, and expose sensitive data. The exploit does not require any external network access beyond normal application traffic, and the vulnerability is already known and documented. Thus, the risk is high for any environment where project‑scoped credentials are not tightly controlled.