Insecure Direct Object Reference Vulnerability in Openpanel Product by Openpanel
CVE-2026-85615

5.3MEDIUM

Key Information:

Vendor

Openpanel-dev

Status
Openpanel
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85615?

Openpanel versions prior to 2.3.0 are susceptible to an insecure direct object reference vulnerability affecting the report.getLayouts and report.resetLayout tRPC procedures. This flaw allows authenticated attackers to manipulate dashboard IDs, enabling access to unauthorized report layouts and configurations, and potentially the ability to delete dashboard grid arrangements across multiple tenants. This vulnerability points to insufficient binding of the dashboardId to the projectId, raising serious concerns about data integrity and tenant isolation.

Affected Version(s)

openpanel 0 < 2.3.0

openpanel 2.3.0

References

https://github.com/Openpanel-dev/openpanel/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/openpanel-before-2.3...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CyberKareem
.