CVE-2026-116809: OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit it by sending anonymous requests to the affected event.bots tRPC procedure. No credentials or user interaction are required.

Q: What information can be exposed?

An attacker who provides a projectId can retrieve bot-event names, types, and paths. This can reveal internal routes for private or password-protected projects.

Q: Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. Projects configured as private or password-protected may still expose bot-event metadata through this procedure.

Q: How can I determine whether my instance is vulnerable?

Verify the deployed OpenPanel version. Versions earlier than 3.0.0 should be treated as affected, particularly if anonymous access to the event.bots tRPC procedure is reachable.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it by sending anonymous requests to the affected event.bots tRPC procedure. No credentials or user interaction are required.

What information can be exposed?

An attacker who provides a projectId can retrieve bot-event names, types, and paths. This can reveal internal routes for private or password-protected projects.

Which deployments are affected?

OpenPanel versions before 3.0.0 are affected. Projects configured as private or password-protected may still expose bot-event metadata through this procedure.

How can I determine whether my instance is vulnerable?

Verify the deployed OpenPanel version. Versions earlier than 3.0.0 should be treated as affected, particularly if anonymous access to the event.bots tRPC procedure is reachable.

CVE-2026-116809: OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which deployments are affected?

How can I determine whether my instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which deployments are affected?

How can I determine whether my instance is vulnerable?