CVE-2026-111670

🗓️ 16 Oct 2026 17:39:31Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 10 Views🌐 WEB

Missing authorization in ClickVisual through 1.1.2 /api/v2/reports allows unauthorized access.

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-111670	16 Oct 202618:33	–	circl
Cvelist	CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module	16 Oct 202617:39	–	cvelist
EUVD	EUVD-2026-102961	16 Oct 202617:39	–	euvd
Mend	CVE-2026-111670	16 Oct 202617:39	–	mend
NVD	CVE-2026-111670	16 Oct 202618:17	–	nvd
Positive Technologies	PT-2026-116069	16 Oct 202600:00	–	ptsecurity

Vulners

Node

clickvisual clickvisualRange0–1.1.2

[
  {
    "vendor": "clickvisual",
    "product": "clickvisual",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "1.1.2",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "packageURL": "pkg:github/clickvisual/clickvisual",
    "repo": "https://github.com/clickvisual/clickvisual"
  }
]

Source	Link
github	www.github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/api/apiv2/report/report.go
vulncheck	www.vulncheck.com/advisories/clickvisual-through-1.1.2-missing-authorization-in-apiv2-report-module
hackmd	www.hackmd.io/@hieuPenguinnn/clickvisual-report-module-missing-authz-cross-instance-idor
github	www.github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/service/report/metadata.go

Parameter	Position	Path	Description	CWE
instance-id	query param	/api/v2/reports	Missing authorization in /api/v2/reports handlers allows low-privileged users to access unauthorized ClickHouse instances by iterating the instance-id parameter.	CWE-862

16 Oct 2026 19:03Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

CVSS 45.3

EPSS0.00251

CWE-862