Missing Authorization Flaw in OpenPanel by OpenPanel Dev

CVE-2026-116810

What is CVE-2026-116810?

OpenPanel versions earlier than 3.0.0 have a vulnerability that allows unauthenticated attackers to exploit missing authorization controls. By utilizing the public reference.getChartReferences tRPC procedure, attackers can craft requests with predictable project IDs to expose critical project annotations across different tenants. The vulnerability potentially allows the retrieval of sensitive information such as annotation titles, descriptions, and timestamps, increasing the risk of data leaks within the platform.

References