CVE-2026-116808

{
  "etk_id": "ETK-2026-2712",
  "cve_id": "CVE-2026-116808",
  "display_id": "CVE-2026-116808",
  "ghsa_id": "GHSA-j23v-hgjh-xpmx",
  "euvd_id": "EUVD-2026-110516",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in OpenPanel profile value handling",
  "summary": "OpenPanel versions before 3.0.0 are affected by an SQL injection flaw in profile value handling. An authenticated user may use crafted property input to bypass project isolation and read data from other tenants.",
  "mitigation": "Upgrade OpenPanel to version 3.0.0 or later. Until upgrading, restrict access to authenticated users and limit exposure of the affected profile-value functionality where feasible.",
  "vendor": "Openpanel-dev",
  "product": "openpanel",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.0.0"
      ],
      "package_name": "openpanel",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.58723585,
  "t0_at": "2026-10-26T23:05:38.546000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-26T23:05:38.546000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-26T23:05:38.546000+00:00",
      "url": "https://github.com/advisories/GHSA-j23v-hgjh-xpmx"
    }
  }
}