Is CVE-2026-116813 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116813?

CVE-2026-116813 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-116813

Description

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDate values with OR 1=1 to neutralize project_id scoping and read other tenants' analytics data.