OpenPanel EUVD-2026-110517

Exploitation requires that the target OpenPanel project has an existing shareOverview row - i.e., an overview share was created and is either private (public:false, including a share toggled off, since the share router has no delete path) OR password-protected (public:true with a password set). Against such projects an attacker needs no session, no authentication, and no user interaction: an anonymous POST to the event.bots tRPC procedure with a known/guessed projectId returns bot-event rows (name, type, path, created_at). LIMITING FACTORS: projects that never created an overview share are not exposed, and the public:true-with-no-password case is excluded because it is public by design; impact is confined to read-only disclosure of bot-event metadata (confidentiality only), with no write, integrity, or availability effect, and the attacker must know or enumerate a valid projectId.

Signals converge on a moderate, confidentiality-only issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity request against a network-facing tRPC endpoint, but impact is limited to VC:L with no integrity or availability effect - consistent with the advisory's 'Confidentiality only' finding. EPSS is low (0.21%, 11th percentile) and the vulnerability is NOT in CISA KEV; SSVC records Exploitation: none, which matches 'no confirmed active exploitation.' Working against urgency reduction, SSVC Automatable: yes and the vuln.today Decision label is 'this_month,' and a concrete PoC request appears in the GHSA advisory, so this is a near-term patch priority rather than something to defer indefinitely - but not an act_now/emergency item. One key data conflict must be flagged: the input metadata says 'Patch: Available from vendor' and EUVD implies a fix at 3.0.0, yet the GitHub advisory source evidence states the fix is 'unreleased' / 'not yet patched' on HEAD 61a9245 - verify fixed-version availability with the vendor before relying on a patch. Net: a real but bounded information-disclosure flaw worth remediating this month, not a widespread-exploitation crisis.

A project owner creates an overview share and sets it private (public:false) or password-protected, assuming the bot-event data stays gated. An anonymous attacker, with no session cookie, sends a crafted POST to /trpc/event.bots with the target's projectId and receives bot-event names, types, and paths back, because the endpoint only checks that a shareOverview row exists rather than enforcing public/password. A public PoC reference exists in the GHSA advisory; it is not verified as working exploit code, and SSVC records no confirmed exploitation.