What is the CVSS score of CVE-2026-55880?

CVE-2026-55880 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of OpenReplay are affected by CVE-2026-55880?

OpenReplay 1.27.0 and earlier contain an authorization flaw allowing any authenticated project member to delete session notes and modify dashboards belonging to other team members.

How to fix or mitigate CVE-2026-55880?

Within 24 hours: Review project membership and permissions; audit API logs for suspicious delete/modification activity on notes and dashboards; identify high-sensitivity projects requiring immediate access restrictions. Within 7 days: Restrict project membership to essential personnel only; implement API rate limiting on notes.delete, dashboards.update_widget, and dashboards.remove_widget endpoints; enable comprehensive audit logging of all dashboard and note modifications. Within 30 days: Monitor vendor security advisories for patched OpenReplay version; schedule upgrade once patch is released; validate fix in pre-production.

OpenReplay CVE-2026-55880

EUVD-2026-43031 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 GitHub_M

Authentication Bypass Openreplay

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network API reachable with low complexity, but a valid low-privilege member account is required (PR:L); no data disclosure (C:N), high integrity from rewriting/deleting others' data (I:H), limited availability loss (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 21:37 vuln.today

DescriptionCVE.org

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.

AnalysisAI

Broken object-level authorization (IDOR) in OpenReplay 1.27.0 and earlier lets any authenticated project member tamper with other users' private data: the notes.delete, dashboards.update_widget, and dashboards.remove_widget backend functions omit the ownership predicate their sibling read/edit functions enforce, so they act on any note or widget matching only an id and project/dashboard id. An authenticated low-privilege member can delete another user's private session notes and remove or rewrite widgets on another user's private dashboards. There is no public exploit identified and no CISA KEV listing; impact is integrity/availability of other tenants' data, not disclosure (CVSS 7.1, C:N/I:H/A:L).

Technical ContextAI

OpenReplay is an open-source, self-hosted session-replay and product-analytics suite; the affected component is its backend API layer that mediates dashboard and note mutations against the shared project database. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the vulnerable mutation queries scope their SQL WHERE clause only to resource identifiers (note id + project id, or dashboard id + widget id) and drop the user-ownership check (e.g. a created_by/user_id predicate) that the corresponding read and edit paths apply. Because authorization is enforced inconsistently across sibling functions rather than centrally, a valid session for any member of a project is sufficient to reference and mutate resources belonging to other members within that project.

RemediationAI

Upgrade to the fixed OpenReplay release published in vendor advisory GHSA-9xfv-p2fx-vmx9 (https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9); the advisory documents the fix but the provided data does not name an exact patched version number, so confirm the target release directly from that advisory before deploying. Because the flaw is server-side authorization logic, client-side controls do not mitigate it and there is no clean configuration toggle; until patched, the most effective compensating control is to limit project membership so that only trusted users share a project (reducing the pool of accounts that could abuse cross-user mutation), and to treat notes/dashboard data as recoverable by enabling or verifying database backups so deleted notes and rewritten widgets can be restored. If your deployment supports it, restrict API access to the notes.delete, dashboards.update_widget, and dashboards.remove_widget endpoints at a proxy layer for non-admin roles, accepting that this will break legitimate note/widget deletion and editing for those users.