CVE-2026-77768 Openpanel-dev CVE debrief

Who should care

Administrators and developers of Openpanel instances, as well as users with access to sensitive reports, should be aware of this vulnerability. The affected product or component is Openpanel, and the vulnerability class is related to access control. The likely operational impact is that unauthorized users could access sensitive report configurations, potentially leading to exposure of sensitive information. Vulnerability management and security teams should review the affected scope and severity to determine the necessary actions. Platform operators should also be aware of the potential impact on their systems.

Technical summary

The report.get procedure in packages/trpc/src/routers/report.ts did not enforce project-scoped access checks, allowing any authenticated user to read full configurations of saved reports by supplying their identifiers. This issue was specific to the report.get procedure, as adjacent update, delete, and duplicate procedures resolved the report first and checked getProjectAccess against the report's own projectId. The technical impact of this issue is that sensitive information, including the owning projectId, event series, filters, breakdowns, and formulas, could be accessed by unauthorized users.

Defensive priority

Authenticated users could access report configurations by ID without project access checks, allowing potential exposure of sensitive information.

Recommended defensive actions

• Review and update access controls for report retrieval procedures
• Implement project-scoped access checks for sensitive report configurations
• Monitor for unauthorized access attempts to report data
• Update documentation to reflect changes in access control policies
• Perform a thorough review of report configurations and access controls
• Verify the implementation of project-scoped access checks
• Track and analyze access logs for report data

Evidence notes

The report.get procedure in packages/trpc/src/routers/report.ts did not enforce access checks for project-scoped reports, allowing any authenticated user to read full configurations of saved reports by supplying their identifiers. This issue was identified in the Openpanel repository, specifically in the report.ts file. The CVE record was published on 2026-08-21T11:17:07.283Z and has not been modified since then. To verify, defenders should review the report configurations and access controls. The evidence limits of this issue are related to the lack of project-scoped access checks, which allowed unauthorized access to sensitive report information.

Official resources