Description

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T23:19:00.323Z",
  "pubdate": "2026-09-14T23:19:00.323Z",
  "executiveSummary": "GrowthBook versions through 5.0.1 are susceptible to an information disclosure vulnerability within their public-facing reporting and experimentation endpoints. The vulnerability stems from the improper handling of data serialization, wherein internal fact table definitions, including sensitive raw warehouse SQL queries, are exposed in the JSON payloads delivered to client-side requests.\nThis flaw allows unauthenticated remote attackers to gain significant insight into the organization's backend data architecture. By identifying a valid public report or experiment identifier, an attacker can extract metadata concerning database schemas, table structures, filter logic, and datasource identifiers. This exposure poses a severe security risk, as the leaked SQL queries and schema information can be leveraged for reconnaissance to facilitate further attacks against the underlying data warehouse, such as unauthorized data exfiltration or targeted SQL injection attempts against internal reporting systems. The vulnerability requires no authentication or special privileges, making it accessible to any network participant with access to the public-facing endpoint.",
  "technicalDetails": "The vulnerability resides in the API endpoints responsible for serving GrowthBook experiment and report configurations. In the affected versions, the application logic fails to properly sanitize or filter the data objects serialized into the API response. Specifically, the fact table definitions—intended for internal administrative use—are included in the response payloads transmitted to the client for public experiments and reports.\nThe root cause is an insecure API response design that does not implement attribute-level access control (ALAC) or data masking for sensitive internal configuration fields. When a client requests data for a specific experiment or report, the server retrieves the associated object from the database, which contains complete metadata, and inadvertently broadcasts these fields globally.\nThe attack flow proceeds as follows: 1. Reconnaissance: An attacker identifies a publicly accessible GrowthBook instance and obtains a valid experiment or report identifier (e.g., through public URLs or discovery). 2. Exploitation: The attacker sends an unauthenticated HTTP GET request to the relevant GrowthBook API endpoint using the discovered identifier. 3. Data Extraction: The server returns a JSON response containing the full definition of the experiment, including the unredacted 'fact table' definitions. 4. Analysis: The attacker parses the JSON body to extract raw SQL queries, database schema information, table names, and datasource identifiers. 5. Post-Exploitation: The attacker utilizes the obtained SQL syntax and schema details to understand the internal data warehouse structure, potentially identifying sensitive table names and filter logic that can be correlated with other reconnaissance data to map out the backend database.\nThis vulnerability effectively bypasses the expected isolation between internal data management systems and public-facing reports. Because the vulnerability is inherent to the data retrieval function for these endpoints, it affects all deployments of GrowthBook 5.0.1 and prior. The risk is heightened by the fact that the exposure is persistent for all experiments or reports that contain fact table definitions, requiring no active interaction from the user beyond the initial request to the public endpoint."
}