CVE-2026-85615: Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts
Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Openpanelto a version that resolves this vulnerability.Fixed in 2.3.0Patch Cross-Tenant IDOR via report.getLayouts
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to make calls to the affected tRPC procedures. They can use their own projectId together with an arbitrary dashboardId belonging to another tenant.
What data or functionality is exposed?
The issue can expose report layouts and configurations from another tenant through report.getLayouts. It can also allow deletion of another tenant's dashboard grid arrangement through report.resetLayout.
Are unauthenticated deployments affected?
The described attack requires authentication, so unauthenticated users cannot exploit it based on the available information. The vulnerability affects Openpanel versions before 2.3.0.
How can I determine whether my deployment is vulnerable?
Check the installed Openpanel version. Versions before 2.3.0 are affected according to the available advisory data.