Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

OpenReplay lets other tenants change feature flags

CVE-2026-45297 · published 5 months ago
Summary

If you run OpenReplay version older than 1.26.0, a user signed in to one tenant could view or modify feature‑flag settings that belong to a different tenant. This could let an outsider see or change configuration data across customer groups. Upgrade OpenReplay to version 1.26.0 or later to close the issue.

Original advisory text
Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-639Authorization Bypass Through User-Controlled Key
CWE-863Incorrect Authorization
Timeline
Published28 May 2026
Updated29 Oct 2026
First seen28 May 2026
Sources
CVE-2026-45297 · NVD
CVE-2026-45297 · OSV
GHSA-5m23-rcj4-cgjx · GHSA
Track software like this
Free during beta