Access Control Weakness in OpenPanel Product

CVE-2026-77768

What is CVE-2026-77768?

The report.get procedure in OpenPanel exhibits an access control vulnerability that allows any authenticated user to retrieve detailed configurations of any saved report using just the reportId. This flaw arises from the enforceAccess middleware, which bypasses necessary projectId or organizationId checks when handling input solely consisting of reportId. As a result, users can inadvertently access sensitive report information, including projectIds, event series, filters, and associated formulas. Unlike update, delete, and duplicate procedures that enforce project-specific access, this particular method lacks the essential security layers, raising concerns about information integrity and confidentiality.

References