GHSA-gv2h-crgm-gfwcMediumCVSS 5.3
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in...
🔗 CVE IDs covered (1)
📋 Description
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-91198
- https://github.com/growthbook/growthbook/issues/6541
- https://github.com/growthbook/growthbook
- https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/app.ts#L391-L409
- https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/services/reports.ts#L880-L890
- https://www.vulncheck.com/advisories/growthbook-through-5.0.1-information-disclosure-via-public-endpoints
- https://github.com/advisories/GHSA-gv2h-crgm-gfwc