OpenPanel EUVD-2026-110518

No special conditions - remote unauthenticated exploitation against default configurations of OpenPanel, requiring only network reachability to the tRPC endpoint. The only practical prerequisite is knowing or guessing a target's slug-based projectId, which is derived from the project name (id.service.ts) and is human-guessable for the first project of a given name. Limiting factors: impact is confined to read-only disclosure of annotation metadata (title, description, date) for projects whose IDs the attacker can guess or enumerate - no write access, no credential or full-dataset exposure - and instances patched to 3.0.0 enforce project-access or unlocked-public-share checks.

Signals point consistently to a genuine but low-to-moderate priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) describes trivially easy remote exploitation - no authentication, no user interaction, low attack complexity - which the source-code evidence fully corroborates: getChartReferences is a publicProcedure whose handler never reads ctx.session or calls a project-access/share gate. However, the impact metrics temper this sharply: VC:L with VI:N/VA:N/SC:N means confidentiality-only disclosure of a narrow data class (annotation titles, descriptions, and dates - release notes and deploy markers), not credentials, integrity, or availability. EPSS is low at 0.25% (16th percentile), it is NOT on CISA KEV, and the vuln.today decision label is 'this_month' (not act_now/emergency), all of which align with the limited-sensitivity confidentiality impact. The tension to flag explicitly: ease of exploitation is high (anonymous, slug-guessable project IDs per id.service.ts) while the value of the leaked data is low, so this is a real, easily-abused cross-tenant leak but one whose business impact depends entirely on how sensitive a given tenant's annotation text is. Exploitation status: a public PoC reference exists in the GHSA advisory; it is not verified as working exploit code, and there is no confirmed active exploitation.

An unauthenticated attacker sends a single POST to /trpc/reference.getChartReferences with no session cookie and a guessed slug-based projectId (e.g. 'acme'), receiving a JSON array of that tenant's annotation {title, description, date} entries. Because project IDs are derived from slug(name) with a random suffix only on collision, the first project of a given name has a human-guessable ID, enabling cross-tenant enumeration. A public PoC reference exists in the advisory; it is not verified as working exploit code.