Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77768: OpenPanel allows any user to view any report

CVE-2026-77768 · published 2 months ago

Summary

In OpenPanel, a request that only includes a report ID can retrieve the full details of that report, even if the user is not part of the project that owns it. This means an authenticated user could see configurations, filters, and formulas of reports they shouldn't access. To fix it, add a check that verifies the user’s project or organization membership before returning the report data.

What to do

Update openpanel-dev openpanel to version 0a51b6805eed0b3da8376175acd5fa3d26819cb6 or later.

Affected software

Vendor	Product	Affected versions
openpanel-dev	openpanel	< 0a51b6805eed0b3da8376175acd5fa3d26819cb6

Original advisory text

OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consisting of a reportId alone passed through unchecked, and getReportById in packages/db/src/services/reports.service.ts performs a findUnique on the report id with no project scoping. Any authenticated user could therefore read the full configuration of any saved report on the instance, including the owning projectId, event series, filters, breakdowns and formulas, by supplying its identifier. The adjacent update, delete and duplicate procedures resolve the report first and check getProjectAccess against the report's own projectId, so the omission was specific to this procedure.

References

https://github.com/Openpanel-dev/openpanel/commit/0a51b6805eed0b3da8376175acd5fa... Patch
https://github.com/Openpanel-dev/openpanel/blob/e8a0602cda5a4d4b463f11d298a1b078... Third Party Advisory
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-9x7c-f87x-22... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77768... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-77768 Vendor Advisory
https://www.vulncheck.com/advisories/openpanel-report-get-returns-any-report-by-... Vendor Advisory
https://github.com/Openpanel-dev/openpanel Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published21 Aug 2026

Updated4 Nov 2026

First seen21 Aug 2026

Sources

CVE-2026-77768 · OSV

CVE-2026-77768 · NVD

CVE-2026-77768 · MITRE

GHSA-9x7c-f87x-2243 · GHSA

Track software like this

Free during beta