Read the docs
TI-2026-54161 Aliases CVE-2026-77768GHSA-g8mq-qr24-3qv3

OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consisting of a reportId alone passed through unchecked, and getReportById in packages/db/src/services/reports.service.ts performs a findUnique on the report id with no project scoping. Any authenticated user could therefore read the full configuration of any saved report on the instance, including the owning projectId, event series, filters, breakdowns and formulas, by supplying its identifier. The adjacent update, delete and duplicate procedures resolve the report first and check getProjectAccess against the report's own projectId, so the omission was specific to this procedure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Openpanel-dev openpanel 0a51b6805eed0b3da8376175acd5fa3d26819cb6

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-54162 OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization BoundariesPriority MEDIUM 64
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77768
  2. 2026-10-03 Alias added: GHSA-g8mq-qr24-3qv3

References

Patch 1

Advisory 1

Other 2

  • TI-2026-63244 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-80976 Sandbox escape in OpenPanel webhook JavaScript templates allows code execution CVSS 4.0HIGH 8.7
  • TI-2026-80973 SQL injection in OpenPanel ClickHouse query lets users read other tenants' data CVSS 4.0HIGH 8.6
  • TI-2026-80981 Missing authentication in OpenPanel Bull Board worker dashboard CVSS 4.0MEDIUM 6.9
  • TI-2026-80975 Missing authorization in OpenPanel exposes project chart annotations CVSS 4.0MEDIUM 6.9
  • TI-2026-63243 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret CVSS 4.0MEDIUM 6.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences