CVE-2026-91198: GrowthBook through 5.0.1 Information Disclosure via Public Endpoints
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments with publicly shared reports or experiments are exposed if an attacker knows the corresponding report or experiment identifier. The affected responses are unauthenticated public endpoints.
What does an attacker need to access the disclosed information?
An attacker needs knowledge of a publicly shared report or experiment identifier. No authentication, privileges, or user interaction are required.
What information could be revealed?
The endpoint payloads can include unredacted fact table definitions and raw warehouse SQL. This may reveal schema and table names, filter values, and datasource identifiers.