Missing Authorization Vulnerability in OpenPanel Affects Non-Admin Users
CVE-2026-116806

5.3MEDIUM

Key Information:

Vendor: Openpanel-dev
Status: Openpanel
Vendor: CVE Published:; 26 October 2026

🔔 Create Openpanel-dev Vulnerability Alert

What is CVE-2026-116806?

OpenPanel prior to version 3.0.0 contains a critical vulnerability in the onboarding.project tRPC mutation. This issue allows non-admin members to create projects and generate write-type ingestion credentials, circumventing established admin-only policies. Attackers can exploit this flaw by repeatedly invoking the vulnerable endpoint using a member session. This could lead to the exposure of plaintext secrets, manipulation of analytics data, and potential exhaustion of the organization's resource budget, threatening overall security posture.