CVE-2026-85615CWE-639

CVE-2026-85615

Medium · published September 4, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-04T16:17Z
References (2)
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-5cpv-vqvr-7mrh · [email protected]https://www.vulncheck.com/advisories/openpanel-before-2.3.0-cross-tenant-idor-via-report-getlayouts · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 11:30Z
    Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts
    cvelistv5