EUVD-2026-75441
GHSA-hpwh-25jq-4wxm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain read-only project membership
-
DeliveryIdentify unprotected mutation resolver endpoints via API or advisory
-
ExploitCraft direct API mutation request
-
ExecutionSubmit request bypassing UI access controls
-
PersistServer executes mutation without access level check
-
ImpactDelete data, modify alerting rules, or publish private analytics publicly
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid OpenPanel account that has been explicitly invited to the target project at the read-only access level. No special system configuration, elevated platform privileges, or physical access is needed - the only prerequisite is project membership, which is granted by a project owner. Direct API calls to mutation resolver endpoints suffice to bypass enforcement, with no user interaction from any other party required. The primary limiting factor is that an external, unauthenticated attacker cannot exploit this vulnerability without first obtaining project-level access; the attack surface is confined to current project members. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N, score 7.2) accurately represents the threat: network-accessible exploitation with no special conditions, requiring only a valid project membership (PR:L), producing high integrity and availability impact against the vulnerable system. The practical risk is significant for multi-tenant deployments or organizations that share OpenPanel projects with external or lower-trust parties - those members can silently destroy data or expose private analytics. However, the exposure is gated on possessing explicit project membership, which limits the exploitable population to insiders or invited collaborators rather than arbitrary internet actors. No EPSS data, CISA KEV listing, or public exploit code was provided, so automated or widespread exploitation probability cannot be assessed from available signals. The lack of subsequent-system impact (SC:N/SI:N/SA:N) contains the blast radius within OpenPanel itself. |
| Exploit ScenarioDerived | A read-only project member opens browser developer tools or uses a scripted API client to directly invoke a mutation resolver - such as the endpoint for scheduling project deletion or publishing a private dashboard to a public share link - without triggering any server-side access check. Because the resolver performs no role validation, the request succeeds identically to one issued by a project owner. The attacker can repeat this across all 26 unprotected mutation endpoints, destroying analytics assets or silently exposing confidential metrics to unauthenticated public URLs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.
RemediationAI
Consult and apply the fix documented in GitHub Security Advisory GHSA-f9rx-pxgw-c6rg (https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-f9rx-pxgw-c6rg) and the corresponding VulnCheck advisory (https://www.vulncheck.com/advisories/openpanel-read-only-access-level-enforcement-bypass-via-mutations) to identify the exact patched release version, which is not independently confirmed in the available data. As a compensating control pending patching, audit all current project memberships and remove or revoke read-only access for untrusted external collaborators from projects containing sensitive analytics data. Restricting API access to internal network segments or authenticated VPN users reduces the attack surface but does not eliminate the underlying authorization flaw. Organizations should also review audit logs for unexpected mutation calls (deletions, publish actions) from read-only accounts to detect any prior exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenPanel (CPE: cpe:2.3:a:openpanel-dev:openpanel:*:*:*:*:*:*:*:*) is an open-source product analytics platform that implements tiered project access levels including a read-only role. The platform exposes a set of mutation resolvers - API endpoints responsible for write and destructive operations - of which 26 out of 29 lack server-side access level validation. CWE-269 (Improper Privilege Management) is the root cause class: the authorization enforcement for these mutations is either absent or applied only at the UI layer, meaning direct API calls bypass any client-side gating entirely. The wildcard CPE indicates no version has been confirmed safe in the available data.
Know when Openpanel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible API requiring read-only project membership (PR:L); C:L for private data exposure via public links; I:H and A:H for data deletion and modification; no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
Technical POC Analysis
Note on evidence: the only artifact supplied is advisory GHSA-f9rx-pxgw-c6rg (main @ ed7bddd, reporter 5ud0).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenPanel's authorization controls fail to restrict administrative functions to privileged users, allowing read-only project members to delete reports, modify alert settings, and expose private analytics. Organizations relying on OpenPanel face uncontrolled data loss, privacy breaches, and compromised operational visibility from both insider threats and account compromise.
No vendor-released patch identified at time of analysis. Until patch is available, implement: restrict read-only project membership to essential personnel only; enable comprehensive audit logging for all API mutations and project operations; enforce multi-step approval workflows for project deletion, report deletion, and analytics publishing; implement role-based API access restrictions at application or API gateway level; conduct monthly access reviews to identify and remediate over-provisioned accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated h
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated m
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into
Unauthenticated ClickHouse SQL injection in OpenPanel before 3.0.0 lets remote attackers read other tenants' analytics d
Sandbox escape in OpenPanel's JavaScript webhook-template runtime (packages/js-runtime) allows an authenticated project
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the m
Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly
Cross-tenant data exposure in OpenPanel before 3.0.0 lets any authenticated user read other projects' profiles, events a
Read-level project members in OpenPanel before 3.0.0 can retrieve plaintext integration secrets - Slack bot tokens, inco
Exploit-DB