GCVE - cpe:2.3:a:clickvisual:clickvisual:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:clickvisual:clickvisual:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Clickvisual (`cbf109fc-db0f-5029-aea5-d6841a7eaa80`)
Product	Clickvisual (`00191831-4c43-5cd9-a856-c9d9b6b1a381`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-111670`	vulnerable	2026-11-03 10:16:11.576886	ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module MEDIUM (4.3) ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables. Published: 2026-10-16T17:39:31.782Z Updated: 2026-10-19T13:25:08.275Z Open on db.gcve.eu Reference links https://hackmd.io/@hieuPenguinnn/clickvisual-report-module-missing-authz-cross-instance-idor https://github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/api/apiv2/report/report.go#L282-L343 https://github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/service/report/metadata.go#L136-L152 https://www.vulncheck.com/advisories/clickvisual-through-1.1.2-missing-authorization-in-apiv2-report-module	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.