CVE-2026-85611
Received Received - Intake

Cross-Tenant BOLA in OpenPanel Dashboard Layouts

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85611
EUVD
EUVD-2026-71030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openpanel openpanel to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85611 is a cross-tenant Broken Object Level Authorization (BOLA) vulnerability in OpenPanel versions before 2.3.0. It affects two tRPC procedures, report.getLayouts and report.resetLayout, which fail to scope dashboard queries to the caller's project. Authenticated attackers can exploit this by supplying their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.

Detection Guidance

To detect this vulnerability, check OpenPanel versions for 2.2.0 or below. Review tRPC procedure calls for report.getLayouts and report.resetLayout. Look for unauthorized access patterns where dashboardId and projectId do not match the authenticated user's project.

Impact Analysis

This vulnerability allows authenticated attackers to read sensitive report definitions, including filter values that may contain account identifiers, or permanently delete dashboard layouts belonging to other organizations. Any authenticated user, regardless of role or membership, can exploit this issue if they have access to a projectId.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's confidentiality rules. Unauthorized disclosure or deletion of report definitions may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade OpenPanel to version 2.3.0 or later. Ensure tRPC procedures report.getLayouts and report.resetLayout scope queries to the caller's projectId. Validate that dashboardId is bound to the authenticated user's projectId in all queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart