CVE-2026-77768
Received Received - Intake

Report Access Bypass in TRPC Report Router

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description
The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consisting of a reportId alone passed through unchecked, and getReportById in packages/db/src/services/reports.service.ts performs a findUnique on the report id with no project scoping. Any authenticated user could therefore read the full configuration of any saved report on the instance, including the owning projectId, event series, filters, breakdowns and formulas, by supplying its identifier. The adjacent update, delete and duplicate procedures resolve the report first and check getProjectAccess against the report's own projectId, so the omission was specific to this procedure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77768
EUVD
EUVD-2026-63901

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openpanel openpanel to 2.3.0 (exc)
openpanel openpanel 2.2.0
openpanel openpanel 2.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any authenticated user to read the full configuration of any saved report on an OpenPanel instance by supplying only the report's identifier. The report.get procedure did not check project or organization access, bypassing the enforceAccess middleware. This exposed sensitive details like project ownership, event series, filters, breakdowns, and formulas.

Detection Guidance

Check for unauthorized access to reports by reviewing logs for report.get procedure calls with only reportId input. Verify if any user accessed reports outside their project scope. Use database queries to audit report access patterns.

Impact Analysis

An attacker could access confidential report configurations belonging to other users or organizations, leading to unauthorized data exposure. This includes sensitive analytics data, project details, and user-specific metrics. The impact is higher in multi-tenant SaaS deployments where cross-tenant data disclosure is possible.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access and potential exposure of personal or sensitive information. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. The breach could result in legal penalties and compliance violations.

Mitigation Strategies

Apply the patch from commit 0a51b68 or upgrade to version 2.3.0. Review and update access controls to enforce project scoping. Audit existing reports for unauthorized access and restrict permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77768. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart