CVE-2026-116810: OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

Q: Which OpenPanel versions are affected?

OpenPanel versions before 3.0.0 are affected.

Q: Does an attacker need an account or other privileges to exploit this issue?

No. The vulnerable tRPC procedure is public, so an unauthenticated attacker can invoke it remotely without user interaction.

Q: What makes a project a practical target for disclosure?

Projects identified through guessable slug-based project IDs can be queried, enabling cross-tenant access to their annotation data.

Published Oct 26, 2026

Updated

OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.

Affected Software

1 affected component

OpenPanel OpenPanel<3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenPanel to a version that resolves this vulnerability.
Fixed in 3.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which OpenPanel versions are affected?

OpenPanel versions before 3.0.0 are affected.

Does an attacker need an account or other privileges to exploit this issue?

No. The vulnerable tRPC procedure is public, so an unauthenticated attacker can invoke it remotely without user interaction.

What makes a project a practical target for disclosure?

Projects identified through guessable slug-based project IDs can be queried, enabling cross-tenant access to their annotation data.

CVE-2026-116810: OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

Affected Software

Remediation

Event History

Frequently Asked Questions

Which OpenPanel versions are affected?

Does an attacker need an account or other privileges to exploit this issue?

What makes a project a practical target for disclosure?

Company

Resources

Contact

Frequently Asked Questions

Which OpenPanel versions are affected?

Does an attacker need an account or other privileges to exploit this issue?

What makes a project a practical target for disclosure?