What is GHSA-gjrj-qcgp-p97f?

GHSA-gjrj-qcgp-p97f is a security advisory published by GitHub Security Advisories with High severity. OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort...

Which CVE IDs does GHSA-gjrj-qcgp-p97f cover?

GHSA-gjrj-qcgp-p97f covers the following CVE IDs: CVE-2026-116812. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gjrj-qcgp-p97f?

GHSA-gjrj-qcgp-p97f has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-gjrj-qcgp-p97fHighCVSS 6.5

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort...

Vendor

GitHub Security Advisories

Published

October 27, 2026

Last Modified

October 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-116812 →

📋 Description

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.

🔗 References (4)

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-gvwr-5684-wjqc
https://nvd.nist.gov/vuln/detail/CVE-2026-116812
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-cohort-preview-profile-filter
https://github.com/advisories/GHSA-gjrj-qcgp-p97f