OpenPanel EUVD-2026-63902

Exploitation requires an authenticated session with membership in at least one project within the target OpenPanel instance - the enforceAccess middleware must be satisfied, meaning anonymous access is not sufficient. The attacker must additionally know or enumerate a valid dashboardId belonging to a different organization on the same instance; if dashboardIds are random UUIDs this requires a secondary information disclosure or insider knowledge, while sequential numeric IDs would be trivially guessable. Exploitation is limited to multi-tenant OpenPanel deployments where multiple organizations coexist on a single instance - single-tenant deployments are not meaningfully exposed. No administrative privileges, special feature flags, or non-default configuration are required beyond basic authenticated membership.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 7.1) accurately characterizes the risk profile: network-accessible, low complexity, requiring only a standard authenticated session, with high confidentiality impact and no integrity or availability consequences. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog. No public proof-of-concept exploit has been identified. The practical risk is highest for multi-tenant OpenPanel deployments where multiple organizations share a single instance; single-tenant deployments face no meaningful cross-organization exposure. The prerequisite of knowing a foreign dashboardId is the primary limiting factor - if dashboardIds are non-guessable UUIDs, exploitation requires prior reconnaissance or a secondary information leak. The fix commit was targeted and the correct pattern already existed in the codebase, suggesting the vulnerability was a localized oversight with a well-understood remediation path.

An attacker with a legitimate account in Organization A enumerates or obtains a dashboardId belonging to Organization B - through a shared public link, sequential ID guessing if IDs are numeric, or a prior information leak. The attacker calls the report.list tRPC endpoint, supplying their own valid projectId from Organization A to satisfy the middleware check and the foreign dashboardId from Organization B, and receives the full set of analytics reports from Organization B's dashboard with no error or audit trail distinguishing this call from a legitimate one. No public exploit code has been identified, but the attack requires only standard HTTP tooling and a valid session token.