ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged… (CVE-2026-111670)

ClickVisual through version 1.1.2 contains a missing authorization vulnerability (CWE-862) in the /api/v2/reports API handlers. Authenticated low-privileged users can exploit this flaw by iterating the instance-id parameter in endpoints such as ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun. This allows unauthorized access to ClickHouse instances and enables enumeration of schemas and inference of row counts for tables that should be restricted. The vulnerability has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a network attack vector with low attack complexity and requiring low privileges, resulting in limited confidentiality impact but no integrity or availability impact.

The vulnerability allows authenticated low-privileged users to bypass authorization controls and access ClickHouse instances they are not permitted to use. This unauthorized access enables attackers to enumerate database schemas and infer row counts of restricted tables, potentially exposing sensitive metadata. However, there is no direct impact on data integrity or availability according to the CVSS vector.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/v2/reports endpoints to only trusted users and monitor for suspicious activity involving instance-id parameter enumeration.