OpenPanel EUVD-2026-75442

Exploitation requires a valid authenticated organization member account in the target OpenPanel instance (PR:L per CVSS). Critically, the access-control bug means even the lowest-privilege 'member' role with no project_access rows is sufficient - the intended level check is bypassed because getProjectAccess returns boolean true rather than a level object. The importer feature must be accessible to the member (no additional configuration required beyond the default code path). The attacker's chosen internal target must be reachable from the network location of the OpenPanel API server process. For cloud metadata exfiltration, the API must run on an instance with an IMDS endpoint available (IMDSv1 is exploitable; IMDSv2 adds a token requirement that partially mitigates). No special platform, browser, or external tooling is required beyond a standard HTTP client or the OpenPanel UI.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) accurately reflects the moderate but real impact: network-accessible, low-complexity, requiring only a valid organization member account. The access-control bypass is particularly significant - it removes the assumption that 'member' role is a meaningful barrier, meaning any successfully registered user becomes an exploitable attacker. The SSRF oracle capability (HTTP status and status text are persisted in Import.errorMessage and returned to the caller) enables port scanning and internal host enumeration without rate-limiting described in the advisory, which increases practical risk beyond a simple blind SSRF. Cloud-hosted deployments are at elevated risk due to cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) being accessible from the application host; even a mid-sized municipal IT team in mielec running OpenPanel in a cloud VPC should treat this as a meaningful lateral-movement stepping stone. No EPSS data is provided in the input; no KEV listing exists. The absence of a patch at publication time is the most operationally significant risk signal - defenders cannot simply update. EPSS and active exploitation status are unconfirmed from available data.

An attacker registers or obtains credentials for any organization member account in a target OpenPanel instance. They submit an import job with fileUrl set to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ or http://10.0.0.1:8080/admin; the OpenPanel API server fetches the URL, and the HTTP status code and status text are stored and returned to the attacker via the import.get endpoint, enabling iterative port scanning and path enumeration of internal infrastructure. If any probed internal service returns a response that parses as Umami CSV, its content is silently ingested into the attacker's analytics views, potentially exfiltrating structured internal data.