CVE-2026-77768 Openpanel-dev CVE debrief

Who should care

Openpanel administrators and users with access to sensitive reports should be aware of this vulnerability and take steps to restrict access to reports. Defenders should prioritize verifying the presence of this vulnerability in their Openpanel deployments and restrict access to sensitive reports. An attacker could read sensitive information from reports, including owning projectId, event series, filters, breakdowns, and formulas. An attacker could use this

Why it matters

CVE-2026-77768 is a high-severity vulnerability in Openpanel that allows any authenticated user to read the full configuration of any saved report on the instance. Defenders should prioritize verifying the presence of this vulnerability and restricting access to sensitive reports.

• An attacker could read sensitive information from reports, including owning projectId, event series, filters, breakdowns, and formulas.
• An attacker could use this information to gain a deeper understanding of the Openpanel instance and potentially exploit other vulnerabilities.
• Defenders should verify the presence of this vulnerability in their Openpanel deployments and restrict access to sensitive reports.

Technical summary

The report.get procedure in Openpanel's trpc router accepts a reportId and returns the report without checking project access. This allows any authenticated user to read the full configuration of any saved report on the instance by supplying its identifier. The enforceAccess middleware does not evaluate membership when the input only contains a reportId, and the getReportById function performs a findUnique query on the report id without project scoping. Defenders should prioritize verifying the presence of this vulnerability in their Openpanel deployments and restrict access to sensitive reports.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Openpanel deployments and restrict access to sensitive reports.

Recommended defensive actions

• Verify the presence of this vulnerability in Openpanel deployments
• Restrict access to sensitive reports
• Implement project scoping for report access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an external researcher and publicly disclosed on GitHub. The CVE record and NVD entry provide additional details about the vulnerability. Defenders should verify the presence of this vulnerability in their Openpanel deployments and restrict access to sensitive reports. The report.get procedure in Openpanel's trpc router accepts a reportId and returns the report without checking project access. This allows any authenticated user to read the full configuration of any saved report on the instance by and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.