OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder due to improper validation of profile.* filter column identifiers before interpolation into ClickHouse WHERE clauses. This allows an authenticated attacker with project-scoped read or root export credentials to inject arbitrary ClickHouse SQL commands. Exploitation can bypass project isolation controls and enable reading of analytics data and profile PII belonging to other organizations using blind boolean oracle techniques. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4. No vendor advisory or patch information is provided.

An attacker with authenticated access and appropriate project-scoped read or root export credentials can exploit this vulnerability to bypass project isolation and retrieve analytics data and personally identifiable information from other organizations. This compromises data confidentiality and privacy within the OpenPanel environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to project-scoped read or root export credentials to trusted users only and monitor for suspicious activity related to analytics filter usage.