CVE-2026-111670: ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

Q: Who can exploit this issue?

An authenticated low-privileged ClickVisual user can exploit it. The attacker must be able to send requests to the /api/v2/reports handlers and supply instance-id values.

Q: What information can an attacker obtain?

By iterating instance-id values, an attacker can access ClickHouse instances they were not granted and enumerate schemas. The affected report operations can also expose table metadata and allow inference of row counts for restricted tables.

Q: Which report operations are affected?

The affected handlers are ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun. These handlers do not enforce authorization for the requested instance.

Q: Are unauthenticated users affected?

The available information identifies exploitation by authenticated low-privileged users. It does not state that unauthenticated access is possible.

Published Oct 16, 2026

Updated

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.

Affected Software

1 affected component

ClickVisual ClickVisual<=1.1.2

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privileged ClickVisual user can exploit it. The attacker must be able to send requests to the /api/v2/reports handlers and supply instance-id values.

What information can an attacker obtain?

By iterating instance-id values, an attacker can access ClickHouse instances they were not granted and enumerate schemas. The affected report operations can also expose table metadata and allow inference of row counts for restricted tables.

Which report operations are affected?

The affected handlers are ReportSourceDatabases, ReportSourceTables, ReportTableColumns, and WhereCheckRun. These handlers do not enforce authorization for the requested instance.

Are unauthenticated users affected?

The available information identifies exploitation by authenticated low-privileged users. It does not state that unauthenticated access is possible.

CVE-2026-111670: ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Which report operations are affected?

Are unauthenticated users affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

Which report operations are affected?

Are unauthenticated users affected?