Vulnerability · Published Aug 21, 2026 · Assigned by VulnCheck
CVE-2026-77769OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in openpanel from Openpanel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Openpanel-dev | openpanel | 0 – before 0a51b6805eed0b3da8376175acd5fa3d26819cb6 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- GHSA-3q95-vc6f-vc9v vendor-advisory
- report.list querying by unverified dashboardId technical-description
- fix: improve access rights patch
- https://github.com/Openpanel-dev/openpanel product
- VulnCheck Advisory: OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries third-party-advisory