Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H N N 7.1 .0024 15.0 —
AFFECTED Product Versions Fixed aptabase unspecified —
TIMELINE Jul 15 Reserved by VulnCheck Jul 21 Published (CNA: VulnCheck) Jul 22 EXPLOIT PUBLISHED — CVE-2026-63080 (aptabase). Public exploit reference added.
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.
| Date | Event | Detail |
|---|---|---|
| July 15, 2026 | Reserved | Reserved by VulnCheck |
| July 21, 2026 | Published | Published (CNA: VulnCheck) |
| July 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-63080 (aptabase). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| aptabase | aptabase | — | — | — |
Authoritative record: CVE-2026-63080 at cve.org
Vendors: aptabase
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-63080 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.