CVE-2026-116818

OpenPanel versions prior to 3.0.0 are vulnerable to an unauthenticated ClickHouse SQL injection vulnerability. The root cause is a lack of session and project-access checks on the /live/visitors/:projectId WebSocket. Remote attackers can inject SQL via the projectId parameter, using techniques li...