Openpanel-dev Openpanel enforceAccess middleware report.ts report.list projectId/dashboardId authorization

Summaryinfo

A vulnerability has been found in Openpanel-dev Openpanel and classified as problematic. This vulnerability affects the function report.list of the file packages/trpc/src/routers/report.ts of the component enforceAccess middleware. Performing a manipulation of the argument projectId/dashboardId results in authorization. This vulnerability is cataloged as CVE-2026-77769. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Openpanel-dev Openpanel (the affected version unknown). It has been classified as problematic. This affects the function report.list of the file packages/trpc/src/routers/report.ts of the component enforceAccess middleware. The manipulation of the argument projectId/dashboardId with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-77769 since 08/21/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Applying the patch 0a51b6805eed0b3da8376175acd5fa3d26819cb6 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Openpanel-dev

Name

• Openpanel

Website

• Product: https://github.com/Openpanel-dev/openpanel/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion