TRPC - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/trpc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 01:51:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenPanel: SQL injection in profile.values (CVE-2026-116808)https://feed.craftedsignal.io/briefs/2026-10-openpanel-sql-injection/Tue, 27 Oct 2026 01:51:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openpanel-sql-injection/OpenPanel versions prior to 3.0.0 contain an SQL injection vulnerability in the profile.values endpoint that allows authenticated attackers to bypass cross-tenant controls and exfiltrate data from other projects.OpenPanel versions prior to 3.0.0 are affected by an SQL injection vulnerability. Authenticated users can manipulate the 'property' parameter within the 'profile.values' endpoint to inject arbitrary SQL expressions. This allows attackers to bypass multi-tenancy protections by including custom SELECT statements, FROM/WHERE clauses, and SQL comments to isolate and exfiltrate profiles, events, and session data belonging to other projects.

Impact

Successful exploitation allows for unauthorized cross-tenant data access, specifically the exfiltration of sensitive information including user profiles, event logs, and session data stored within the OpenPanel platform.

Recommendation

  • Upgrade all instances of OpenPanel to version 3.0.0 or later to remediate CVE-2026-116808.
  • Implement request logging on the 'profile.values' endpoint to audit 'property' parameter values for potential SQL injection characters such as comment sequences (--) or SQL keywords (SELECT, UNION, FROM).
]]>highadvisoryweb-applicationsql-injectioncve-2026-116808information-disclosuretRPCopenpanel