OpenPanel CVE-2026-85611

Exploitation requires a valid OpenPanel account in any tenant - authentication cannot be bypassed. The attacker must know or enumerate a victim organization's dashboardId; the CVE description explicitly characterizes these identifiers as 'guessable,' indicating they are likely non-random (sequential numeric or similarly predictable). Both read (report.getLayouts) and destructive delete (report.resetLayout) exploitation paths are possible with the same conditions. Exploitation is meaningful only in multi-tenant OpenPanel deployments running versions before 2.3.0; single-organization deployments have no exploitable cross-tenant boundary. No specific non-default configuration is required beyond the presence of reports and dashboard layouts created by other tenants.

The CVSS 4.0 score of 5.3 (Medium) is broadly appropriate given the authentication requirement (PR:L) and the limited per-object confidentiality and integrity impacts (VC:L/VI:L). The secondary-system metrics (SC:L/SI:L) correctly capture the cross-tenant scope change. Practical exploitation is constrained by the need for a valid account and the ability to guess victim dashboardIds - the description's own characterization of IDs as 'guessable' suggests non-random (e.g., sequential or short numeric) identifiers, which meaningfully lowers real-world attack complexity below what AC:L alone conveys. EPSS data is absent from the input; no KEV listing confirms active exploitation. For multi-tenant SaaS deployments of OpenPanel the risk is moderate - confidential business analytics data and dashboard configuration can be exfiltrated or destroyed by any authenticated tenant. Single-tenant self-hosted deployments face negligible cross-tenant exposure.

An attacker with a legitimate OpenPanel account in their own tenant iterates over numeric or otherwise predictable dashboardId values, calling report.getLayouts with their own projectId paired with each candidate ID until a victim organization's report definitions are returned. With a confirmed victim dashboardId in hand, the attacker then calls report.resetLayout to permanently delete the victim's dashboard layouts, causing irreversible data loss across the tenant boundary. No public exploit code is identified at time of analysis, but the attack requires only standard authenticated HTTP requests to the tRPC endpoint.