An authenticated SQL injection vulnerability in OpenPanel permits unauthorized access to sensitive organization data and PII, posing a significant risk to data confidentiality.

This vulnerability is an SQL injection flaw within the analytics filter builder, where profile filter column identifiers are not validated before being included in ClickHouse queries. An attacker with project-scoped read or root export credentials can execute arbitrary SQL to extract data belonging to other organizations.

The exploitation of this vulnerability leads to a critical breach of multi-tenancy boundaries, allowing unauthorized access to sensitive analytics data and profile PII. With a CVSS score of 8.5, this high-severity flaw carries substantial risk of regulatory non-compliance, loss of customer trust, and unauthorized data exposure.

Immediate Action: Monitor the official OpenPanel security advisory page for the release of a patched version and apply the update as soon as it becomes available.

Proactive Monitoring: Review database query logs for suspicious patterns or anomalous syntax within ClickHouse queries that indicate attempts to exploit the filter builder.

Compensating Controls: Restrict access to analytics and export features to trusted users only and implement database-level access controls to limit the scope of data reachable by specific service accounts.

Public Exploit Available: No (exploit_available: false)

Given the ability for an authenticated user to bypass project isolation and access sensitive cross-tenant data, this vulnerability must be treated as a priority. Security teams should identify all users with the affected credentials and ensure the software is updated immediately upon vendor release to prevent potential data exfiltration.