CVE-2026-63080

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-63080

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63080.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-63080

Published

2026-07-21T21:02:08Z

Modified

2026-10-08T02:51:35Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Aptabase SQL Injection via ClickHouse query backend

Details

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63080.json"
}

References

Affected packages

Git / github.com/aptabase/aptabase

Affected ranges

Type: GIT
Repo: https://github.com/aptabase/aptabase
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last Affected

5a8936852a20c26267ffaefd3544f91e3ca94135

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63080.json"