Missing Authorization Vulnerability in OpenPanel by OpenPanel Dev
CVE-2026-116809

6.9MEDIUM

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116809?

OpenPanel, prior to version 3.0.0, contains a vulnerability that permits unauthenticated users to exploit the event.bots tRPC procedure. This flaw allows attackers to access sensitive information, including bot event names, types, and paths associated with private or protected projects. By leveraging this vulnerability, an attacker can send anonymous requests using a project ID, potentially exposing internal routes and sensitive data. This issue underscores the importance of implementing robust authentication measures.

Affected Version(s)

openpanel 0 < 3.0.0

openpanel 3.0.0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/openpanel-before-3.0...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.