OpenPanel CVE-2026-116806

Requires an authenticated, non-admin member (any role, including read-only) of the target OpenPanel organization and a valid organizationId the caller already belongs to; no admin role, no user interaction, and no non-default configuration are needed, because the onboarding.project mutation is only gated by generic membership (enforceAccess/member.findFirst) and never calls requireOrganizationAdmin in versions before 3.0.0 (2.3.0 confirmed vulnerable). The mutation is unlimited and unthrottled, so credentials can be minted repeatedly. Limiting factors that bound realistic risk: the attacker must already possess a provisioned member session in the org (no path from an unauthenticated outsider); foreign organizations are unreachable because the membership middleware rejects non-member organizationId values; and the minted write-type credential cannot read existing data (export/import endpoints reject ClientType.write) nor manage resources (manage surface is root-only), so impact is confined to event injection, metrics poisoning, and budget consumption.

This is a medium-severity, authenticated privilege-ladder bypass (CWE-269) whose real-world risk is moderate-to-low rather than urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) and the 5.3 base score agree: network-reachable and low-complexity, but it requires an existing authenticated organization member (PR:L), has no confidentiality impact, and only Low integrity/availability impact bounded to a single organization. EPSS is low (0.24%, 15th percentile) and the vulnerability is NOT in CISA KEV, indicating no evidence of active exploitation. A proof-of-concept is published in the vendor GHSA advisory, so exploitation is trivial for anyone who already holds a non-admin member session - but that membership prerequisite makes this primarily an insider or post-compromise escalation, not a mass-exploitable remote flaw. The vuln.today decision label 'this_month' aligns with these signals: patch on a normal cycle rather than emergency. One conflict must be flagged: the CVE title and EUVD list the fix as 3.0.0 and the input says a vendor patch is available (commit 35c2a138), yet the GHSA source-evidence block states 'fixed in: not yet patched' and marks 2.3.0 vulnerable - verify the actual fixed release with the vendor before relying on a version number.

A disgruntled, low-privilege, or compromised non-admin member of an OpenPanel organization repeatedly POSTs to the onboarding.project tRPC endpoint with their ordinary session cookie, each call minting a new project and a write-type ingestion credential whose plaintext secret is returned in the response - despite the admin-only policy that governs the sibling project.create and client.create procedures. Using those secrets, the attacker injects fabricated analytics events to poison revenue/conversion/attribution dashboards, trigger event-driven automations, and exhaust the organization's usage budget. A browser-console fetch and an equivalent curl PoC are published in the vendor's GHSA advisory; exploitation is network-reachable but requires an authenticated member session and low attack complexity.