EUVD-2026-63902
GHSA-mrm7-hxjw-vff5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated session (PR:L), network-accessible with no complexity (AV:N/AC:L), read-only data exposure with no scope change or integrity/availability impact (S:U/C:H/I:N/A:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it.
AnalysisAI
Cross-organization report data exposure in OpenPanel allows any authenticated user to read all analytics reports belonging to another organization's dashboard by supplying a mismatched projectId and dashboardId pair to the report.list tRPC procedure. The enforceAccess middleware validated only project membership, not dashboard ownership, while the underlying getReportsByDashboardId query applied no project-scoping filter - enabling a classic IDOR across tenant boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with membership in at least one project within the target OpenPanel instance - the enforceAccess middleware must be satisfied, meaning anonymous access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately characterizes the risk profile: network-accessible, low complexity, requiring only a standard authenticated session, with high confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a legitimate account in Organization A enumerates or obtains a dashboardId belonging to Organization B - through a shared public link, sequential ID guessing if IDs are numeric, or a prior information leak. The attacker calls the report.list tRPC endpoint, supplying their own valid projectId from Organization A to satisfy the middleware check and the foreign dashboardId from Organization B, and receives the full set of analytics reports from Organization B's dashboard with no error or audit trail distinguishing this call from a legitimate one. … |
| Remediation | The upstream fix is available in commit 0a51b6805eed0b3da8376175acd5fa3d26819cb6 on the Openpanel-dev/openpanel repository (https://github.com/Openpanel-dev/openpanel/commit/0a51b6805eed0b3da8376175acd5fa3d26819cb6), which adds a getDashboardById(dashboardId, projectId) ownership check in the report.list procedure before returning any data, throwing a TRPCNotFoundError if the dashboard does not belong to the supplied project. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit OpenPanel access logs to identify any unauthorized cross-organization report access by searching for projectId-dashboardId mismatches and notify potentially affected customers; restrict OpenPanel user base to essential personnel only and disable public or contractor access until remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today