Product
OpenPanel versions prior to 3.0.0 contain an SQL injection vulnerability in the profile.values endpoint that allows authenticated attackers to bypass cross-tenant controls and exfiltrate data from other projects.