Aptabase through commit 5a89368 has a SQL injection vulnerability in its ClickHouse query backend. Authenticated attackers can exploit unsanitized filter parameters in Liquid SQL templates to read event data across all tenants. Malicious input in parameters such as EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId can inject a UNION ALL statement that bypasses tenant isolation filters on most stats API endpoints.