Openpanel CVE-2026-85615

Exploitation requires a valid authenticated account on the same Openpanel instance as the victim (PR:L confirmed by CVSS vector). The attacker must also know or enumerate a target dashboardId belonging to a different tenant; whether dashboardIds are predictable, sequential, or UUIDs is not specified in available data. The flaw is present in multi-tenant deployments where tenant isolation is expected; single-tenant self-hosted instances where all users are in the same organization face a lower-severity intra-org privilege escalation scenario. There is no requirement for special configuration - the tRPC procedures are part of the standard application feature set. Exploitation is limited by the requirement for authentication and knowledge of a target dashboardId; brute-force enumeration of dashboardIds could expand the attack surface.

The CVSS 4.0 score of 5.3 (Medium) is calibrated appropriately. The vector AV:N/AC:L/AT:N/PR:L/UI:N captures a straightforward network-exploitable flaw requiring only a valid account; attack complexity is genuinely low since dashboardIds may be enumerable or discoverable through normal application use. The subsequent-system impact metrics SC:L/SI:L reflect the cross-tenant boundary violation, which is the real business risk - tenants operate under an expectation of data isolation. Impact is bounded: layouts and grid configurations are meta-data about dashboards, not underlying analytics event data or credentials, so C:L/I:L is accurate. No EPSS data was supplied. The vulnerability is not listed in CISA KEV, and no POC has been publicly released at time of analysis, keeping real-world exploitation risk moderate. The key real-world threat is an insider or competitor on the same shared instance enumerating and resetting competitor dashboards - meaningful reputational and data-integrity harm in a SaaS context even without full data exfiltration.

An authenticated user on a shared Openpanel instance obtains or enumerates a competitor tenant's dashboardId - which may be exposed through browser network traffic or application URLs during normal product use. The attacker calls the report.getLayouts tRPC endpoint with their own valid session token but substitutes the victim's dashboardId, receiving the victim's dashboard layout and widget configuration in response. They then call report.resetLayout with the same dashboardId to wipe the victim's dashboard arrangement, causing operational disruption without leaving obvious attribution traces.