CVE-2026-85611CWE-639

CVE-2026-85611

Medium · published September 4, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim organization's guessable dashboardId to read confidential report definitions or permanently delete dashboard layouts across tenant boundaries.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-04T16:17Z
References (3)
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-g3xf-pqfp-22v7 · [email protected]https://www.vulncheck.com/advisories/openpanel-before-2.3.0-cross-tenant-bola-via-report-procedures · [email protected]https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-g3xf-pqfp-22v7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:30Z
    OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures
    cvelistv5