What’s Vulnerable › Vulnerabilities

CVE-2026-91198: GrowthBook through 5.0.1 Information Disclosure via Public Endpoints

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-16
• Weakness: CWE-201

Description

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.

Affected products

• growthbook: through 5.0.1

References

• https://github.com/growthbook/growthbook
• https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/app.ts#L391-L409
• https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/services/reports.ts#L880-L890
• https://github.com/growthbook/growthbook/issues/6541
• https://www.vulncheck.com/advisories/growthbook-through-5.0.1-information-disclosure-via-public-endpoints

Get alerted when CVE-2026-91198 or the next vulnerability affects your stack