Openpanel-dev Openpanel Report Retrieval reports.service.ts getReportById reportId access control

Summaryinfo

A vulnerability, which was classified as problematic, was found in Openpanel-dev Openpanel. This affects the function getReportById of the file packages/db/src/services/reports.service.ts of the component Report Retrieval. Such manipulation of the argument reportId leads to access control. This vulnerability is listed as CVE-2026-77768. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Openpanel-dev Openpanel (affected version not known) and classified as problematic. Affected by this issue is the function getReportById of the file packages/db/src/services/reports.service.ts of the component Report Retrieval. The manipulation of the argument reportId with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. CVE summarizes:

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consisting of a reportId alone passed through unchecked, and getReportById in packages/db/src/services/reports.service.ts performs a findUnique on the report id with no project scoping. Any authenticated user could therefore read the full configuration of any saved report on the instance, including the owning projectId, event series, filters, breakdowns and formulas, by supplying its identifier. The adjacent update, delete and duplicate procedures resolve the report first and check getProjectAccess against the report's own projectId, so the omission was specific to this procedure.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-77768 since 08/21/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Applying the patch 0a51b6805eed0b3da8376175acd5fa3d26819cb6 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Openpanel-dev

Name

• Openpanel

Website

• Product: https://github.com/Openpanel-dev/openpanel/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion