Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck

CVE-2026-88891OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations

High 8.3

In plain English

A high-severity privilege mismanagement in openpanel from Openpanel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.

Affected products (as reported)

Vendor	Product	Versions
Openpanel-dev	openpanel	0 – through 2.3.0

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References

GitHub Security Advisory (GHSA-f9rx-pxgw-c6rg) vendor-advisory
https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83 patch
VulnCheck Advisory: OpenPanel Read-Only Access Level Enforcement Bypass via Mutations third-party-advisory