CVE-2026-116806: OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

Q: Who can exploit this issue?

Any non-admin member of an OpenPanel organization can exploit it using a member session. No user interaction is required.

Q: What access does exploitation provide?

An attacker can create projects and obtain plaintext write-type ingestion credentials despite the intended admin-only restriction. Those credentials can be used to submit fake analytics events, corrupt metrics, and consume the organization's usage budget.

Q: Are default deployments affected?

The issue affects OpenPanel versions before 3.0.0 where organization members can access the onboarding.project tRPC mutation. The provided data does not identify any configuration prerequisite beyond a valid non-admin member session.

Q: What can be done before upgrading?

Restrict or remove non-admin members' access to the affected endpoint if possible, and review organization membership. Because credentials can be minted repeatedly, monitor for unexpected project creation, ingestion credentials, anomalous event submissions, metric changes, and usage consumption.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any non-admin member of an OpenPanel organization can exploit it using a member session. No user interaction is required.

What access does exploitation provide?

An attacker can create projects and obtain plaintext write-type ingestion credentials despite the intended admin-only restriction. Those credentials can be used to submit fake analytics events, corrupt metrics, and consume the organization's usage budget.

Are default deployments affected?

The issue affects OpenPanel versions before 3.0.0 where organization members can access the onboarding.project tRPC mutation. The provided data does not identify any configuration prerequisite beyond a valid non-admin member session.

What can be done before upgrading?

Restrict or remove non-admin members' access to the affected endpoint if possible, and review organization membership. Because credentials can be minted repeatedly, monitor for unexpected project creation, ingestion credentials, anomalous event submissions, metric changes, and usage consumption.

CVE-2026-116806: OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Are default deployments affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does exploitation provide?

Are default deployments affected?

What can be done before upgrading?