Medium severity · published Sep 14, 2026
CVE-2026-91198
GrowthBook through 5.0.1 Information Disclosure via Public Endpoints
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
growthbook · growthbook
through 5.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91198
github.com
https://github.com/growthbook/growthbook
github.com
https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/app.ts#L391-L409
github.com
https://github.com/growthbook/growthbook/blob/57d07471b137eb43d9bfb1613d0a1203d21fef88/packages/back-end/src/services/reports.ts#L880-L890
github.com
https://github.com/growthbook/growthbook/issues/6541
www.vulncheck.com
https://www.vulncheck.com/advisories/growthbook-through-5.0.1-information-disclosure-via-public-endpoints
More from growthbook
7.5
CVE-2022-36065
GrowthBook account creation and file upload vulnerability in self-hosted configurations