CVE-2026-77769
Received Received - Intake

Unauthorized Report Access via Dashboard ID in Product

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description
The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77769
EUVD
EUVD-2026-63902

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openpanel openpanel 2.3.0
openpanel openpanel to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77769 is an authorization bypass vulnerability in the OpenPanel API. It allows an authenticated user to access reports from any dashboard on the instance by exploiting an unverified dashboardId parameter. The report.list procedure checks project membership via projectId but fails to validate that the dashboardId belongs to that project. This lets a user pair their own projectId with a dashboardId from another organization, bypassing access controls and retrieving sensitive report metadata.

Detection Guidance

To detect this vulnerability, inspect tRPC API calls to the report.list procedure for requests containing both projectId and dashboardId parameters. Check if the dashboardId is validated against the projectId in the backend. Look for unauthorized report access patterns where users retrieve reports from dashboards outside their project scope.

Impact Analysis

This vulnerability allows an attacker to access sensitive report data, including event names, filter logic, and project details, across tenant boundaries. For example, a user from Organization B could list reports from Organization A's dashboards without authorization. This could lead to unauthorized data exposure, business intelligence leaks, and potential compliance violations.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection and unauthorized access) and HIPAA (protected health information exposure). It enables unauthorized access to sensitive data across organizations, potentially leading to data breaches and regulatory penalties due to insufficient access controls and project scoping.

Mitigation Strategies

Upgrade OpenPanel to version 2.3.0 or later. Ensure the report.list procedure uses listReportsCore or similar scoped helper to validate dashboardId belongs to the projectId. Review API access logs for suspicious cross-project report queries and revoke unauthorized access immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart