CVE-2026-85615

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85615

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85615.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85615

Aliases

GHSA-5cpv-vqvr-7mrh

Published

2026-09-04T11:30:10Z

Modified

2026-10-03T03:46:59Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Details

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85615.json"
}

References

Affected packages

Git / github.com/openpanel-dev/openpanel

Affected ranges

Type

GIT

Repo

https://github.com/openpanel-dev/openpanel

Events

Introduced

Fixed

cd24bb838301df1a9087e2e132b344e5b8a99963

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.3.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85615.json"