Read the docs
TI-2026-33097 Aliases CVE-2026-45297

Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch

Priority LOW 29CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed openreplay (openreplay): 1.26.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openreplayopenreplaybefore 1.26.01.26.0Patch availableCNA
  • openreplay Vendoropenreplay Affected before 1.26.0 Fixed in 1.26.0 Patch available CNA

Remediation

  • Fix · CNA openreplay (openreplay) Fixed in 1.26.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45297

References

Other 1

  • TI-2026-40332 OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover CVSS 3.1CRITICAL 9.3
  • TI-2026-22713 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-33096 OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding CVSS 3.1HIGH 7.7
  • TI-2026-40334 OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint CVSS 4.0HIGH 7.1
  • TI-2026-40333 OpenReplay: Cross-user IDOR in notes and dashboard widgets CVSS 3.1HIGH 7.1
  • TI-2023-26090 OpenReplay HTML Injection vulnerability CVSS 3.1MEDIUM 6.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences