CyberRota Analysis
AI-GeneratedGrowthBook versions up to 5.0.1 are vulnerable due to the exposure of unredacted fact table definitions, which include sensitive raw SQL queries, through unauthenticated public report and experiment endpoints. This vulnerability allows attackers who possess a shared report or experiment identifier to access internal data warehouse details, potentially leading to data leakage and unauthorized insights. Organizations using GrowthBook should prioritize addressing this issue to mitigate risks associated with data exposure and ensure the security of their internal data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.