CVE-2026-111670
Deferred Deferred - Pending Action

ClickVisual Missing Authorization in ClickHouse Access via Report Handlers

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111670
EUVD
EUVD-2026-102961

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
clickvisual clickvisual 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ClickVisual through version 1.1.2 has a missing authorization vulnerability in its API v2 report handlers. Authenticated low-privileged users can access ClickHouse instances they were not granted by manipulating the instance-id parameter in endpoints like ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun. This allows enumeration of schemas and inference of row counts for restricted tables across unauthorized instances.

Detection Guidance

To detect this vulnerability, check if authenticated low-privileged users can access unauthorized ClickHouse instances via the /api/v2/reports endpoints. Test by sending requests with manipulated instance-id parameters to ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun endpoints. Verify if unauthorized schema or table data is returned.

Impact Analysis

An attacker with valid access can exploit this to bypass permission boundaries in multi-tenant environments. They can list all ClickHouse instances, query databases, tables, and columns of any instance, and infer row counts for unauthorized tables. This leads to full schema disclosure and potential data exposure across all managed ClickHouse instances.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of schemas and row counts of restricted tables may indicate unauthorized data access, potentially resulting in non-compliance with data protection regulations and legal penalties.

Mitigation Strategies

Upgrade ClickVisual to a version beyond 1.1.2 where this issue is fixed. If upgrading is not immediately possible, restrict access to the /api/v2/reports endpoints and implement proper authorization checks to validate user permissions against instance IDs. Review and enforce per-instance access controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart