CVE-2026-63080 Overview
CVE-2026-63080 is a SQL injection vulnerability [CWE-89] in Aptabase, an open-source analytics platform. The flaw exists in the ClickHouse query backend through commit 5a89368. Authenticated attackers can inject unsanitized filter parameters into Liquid SQL templates to read event data across all tenants. The vulnerability affects thirteen of the fifteen stats API endpoints. Attackers supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters. A crafted UNION ALL statement bypasses the app_id tenant isolation filter, breaking multi-tenant data boundaries.
Critical Impact
Authenticated attackers can extract event telemetry belonging to other tenants, breaking application-level tenant isolation in shared Aptabase deployments.
Affected Products
- Aptabase (self-hosted analytics platform)
- Aptabase through commit 5a89368
- Aptabase ClickHouse query backend and stats API endpoints
Discovery Timeline
- 2026-07-21 - CVE-2026-63080 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-63080
Vulnerability Analysis
Aptabase constructs ClickHouse queries using Liquid templates that interpolate user-controlled filter values directly into the SQL string. The stats API accepts filter parameters intended to scope results by event, country, operating system, device, application version, or session. These filter values reach the Liquid template rendering stage without parameterization or escaping. The rendered SQL is executed against ClickHouse with the calling tenant's app_id constraint. Because the injection point sits inside the same statement as the tenant filter, an attacker can append a UNION ALL clause that selects rows from other app_id values. The result set returned to the attacker includes event records that belong to unrelated tenants, violating the isolation model of the multi-tenant deployment.
Root Cause
The root cause is string concatenation of untrusted input into SQL rendered by the Liquid templating engine. The backend treats filter parameters as trusted template variables rather than user data requiring parameter binding. No input validation, allow-listing, or bind-parameter mechanism separates data from query structure at the ClickHouse driver layer.
Attack Vector
Exploitation requires an authenticated Aptabase account. The attacker sends an HTTP request to any of the thirteen vulnerable stats API endpoints with a crafted value in one of the filter parameters. The payload closes the current predicate, appends UNION ALL SELECT targeting the events table without an app_id filter, and comments out trailing SQL. The response returns cross-tenant event data alongside the attacker's own results. Refer to the VulnCheck Security Advisory and the YoyoChaud CVE-2026-63080 Analysis for full payload details.
Detection Methods for CVE-2026-63080
Indicators of Compromise
- HTTP requests to Aptabase stats API endpoints containing the substring UNION ALL or UNION SELECT in filter query parameters.
- Filter parameter values containing SQL comment sequences such as --, /*, or unbalanced quotes in EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId.
- ClickHouse query logs showing SELECT statements without the expected app_id predicate or with multiple app_id values in a single UNION.
Detection Strategies
- Inspect application access logs for anomalous lengths and non-alphanumeric characters in filter parameters submitted to the stats API.
- Enable ClickHouse query_log and alert on queries against the events table that omit the tenant app_id filter.
- Correlate a single authenticated session issuing requests referencing multiple app_id values in a short time window.
Monitoring Recommendations
- Forward Aptabase reverse-proxy logs and ClickHouse query logs to a centralized analytics pipeline for retention and search.
- Baseline normal filter parameter values per tenant and alert on deviations such as SQL keywords or encoded payloads.
- Track authenticated user actions that return volumes of event data inconsistent with the tenant's own dataset size.
How to Mitigate CVE-2026-63080
Immediate Actions Required
- Upgrade Aptabase to a build later than commit 5a89368 that parameterizes filter values in the ClickHouse query backend.
- Restrict Aptabase account provisioning and rotate credentials for any account that may have been used to test the flaw.
- Audit ClickHouse query logs and application logs for prior exploitation attempts against the stats API endpoints.
Patch Information
Apply the upstream fix that replaces Liquid template interpolation of filter values with bound parameters in the ClickHouse driver. Verify that the app_id tenant filter is enforced server-side and cannot be bypassed by user-supplied SQL fragments. Consult the VulnCheck Security Advisory for the fixed commit reference.
Workarounds
- Place a web application firewall in front of Aptabase and block requests whose filter parameters contain SQL keywords such as UNION, SELECT, or comment tokens.
- Restrict access to the Aptabase stats API to trusted IP ranges until the patched build is deployed.
- Temporarily disable multi-tenant sharing of the Aptabase instance so a single tenant occupies each deployment, eliminating cross-tenant exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
