CVE-2026-91198

Received Received - Intake

GrowthBook Fact Table Definitions Exposure via Public Endpoints

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-91198

EUVD

EUVD-2026-78207

Affected Vendors & Products

Vendor	Product	Version / Range
growthbook	growthbook	5.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

GrowthBook through version 5.0.1 exposes unredacted fact table definitions in API responses from unauthenticated public report and experiment endpoints. This includes raw warehouse SQL queries, schema details, table names, filter values, and datasource identifiers. Attackers can access this sensitive information if they know a valid report or experiment identifier.

Detection Guidance

Check GrowthBook endpoints for unauthenticated access to reports or experiments. Look for unredacted payloads containing SQL queries or internal data warehouse details. Monitor network traffic for suspicious requests to GrowthBook API paths.

Impact Analysis

An attacker could read internal data warehouse queries, revealing database structure, sensitive table names, and filter logic. This may lead to further attacks like data exfiltration, unauthorized access to other systems, or intellectual property theft if internal queries contain proprietary logic.

Mitigation Strategies

Disable public access to report and experiment endpoints. Implement authentication for all GrowthBook API endpoints. Update GrowthBook to the latest version beyond 5.0.1 to patch the issue.

Hi! I’m here to help you understand CVE-2026-91198. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70