CVE-2026-77769
OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries
Description
The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it.
INFO
Published Date :
Aug. 21, 2026, 11:17 a.m.
Last Modified :
Oct. 16, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-77769
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Modify report.list to use listReportsCore.
- Update getReportsByDashboardId to include project scoping.
- Validate dashboard ID against project ID in access checks.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-77769.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-77769 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-77769
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-77769 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-77769 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 16, 2026
Action Type Old Value New Value Changed Translation Title: openpanel de Openpanel-dev, Description: El procedimiento report.list en packages/trpc/src/routers/report.ts aceptaba un projectId y un dashboardId y devolvía getReportsByDashboardId(dashboardId). El middleware enforceAccess en packages/trpc/src/trpc.ts verificaba la membresía para el projectId proporcionado, pero nada verificaba que el dashboardId proporcionado perteneciera a ese proyecto, y getReportsByDashboardId en packages/db/src/services/reports.service.ts selecciona informes solo por dashboardId sin alcance de proyecto. Un usuario autenticado podría, por lo tanto, emparejar un projectId de su propia organización, lo que satisface el middleware, con un dashboardId perteneciente a otra organización y recibir cada informe en ese dashboard. Una función auxiliar con el alcance correcto, listReportsCore, ya existía en el mismo archivo de servicio y resuelve el dashboard a través de getDashboardById(dashboardId, projectId) antes de devolver los informes, pero el router no lo usaba. Title: openpanel de Openpanel-dev, Description: El procedimiento report.list en packages/trpc/src/routers/report.ts aceptaba un projectId y un dashboardId y devolvía getReportsByDashboardId(dashboardId). El middleware enforceAccess en packages/trpc/src/trpc.ts verificaba la membresía para el projectId proporcionado, pero nada verificaba que el dashboardId proporcionado perteneciera a ese proyecto, y getReportsByDashboardId en packages/db/src/services/reports.service.ts selecciona informes solo por dashboardId sin alcance de proyecto. Un usuario autenticado podría, por lo tanto, emparejar un projectId de su propia organización, lo que satisface el middleware, con un dashboardId perteneciente a otra organización y recibir cada informe en ese dashboard. Una función auxiliar con el alcance correcto, listReportsCore, ya existía en el mismo archivo de servicio y resuelve el dashboard a través de getDashboardById(dashboardId, projectId) antes de devolver los informes, pero el router no lo usaba. -
CVE Translated by [email protected]
Oct. 16, 2026
Action Type Old Value New Value Added Translation Title: openpanel de Openpanel-dev, Description: El procedimiento report.list en packages/trpc/src/routers/report.ts aceptaba un projectId y un dashboardId y devolvía getReportsByDashboardId(dashboardId). El middleware enforceAccess en packages/trpc/src/trpc.ts verificaba la membresía para el projectId proporcionado, pero nada verificaba que el dashboardId proporcionado perteneciera a ese proyecto, y getReportsByDashboardId en packages/db/src/services/reports.service.ts selecciona informes solo por dashboardId sin alcance de proyecto. Un usuario autenticado podría, por lo tanto, emparejar un projectId de su propia organización, lo que satisface el middleware, con un dashboardId perteneciente a otra organización y recibir cada informe en ese dashboard. Una función auxiliar con el alcance correcto, listReportsCore, ya existía en el mismo archivo de servicio y resuelve el dashboard a través de getDashboardById(dashboardId, projectId) antes de devolver los informes, pero el router no lo usaba. -
CVE Modified by [email protected]
Aug. 26, 2026
Action Type Old Value New Value Added Reference https://github.com/Openpanel-dev/openpanel Added Reference https://github.com/Openpanel-dev/openpanel/blob/e8a0602cda5a4d4b463f11d298a1b078c446bf33/packages/trpc/src/routers/report.ts Added Reference https://github.com/Openpanel-dev/openpanel/commit/0a51b6805eed0b3da8376175acd5fa3d26819cb6 Added Reference https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-3q95-vc6f-vc9v Added Reference https://www.vulncheck.com/advisories/openpanel-report-list-queries-reports-by-an-unverified-dashboardid-crossing-organization-boundaries Removed Reference https://github.com/Openpanel-dev/openpanel Removed Reference https://github.com/Openpanel-dev/openpanel/blob/e8a0602cda5a4d4b463f11d298a1b078c446bf33/packages/trpc/src/routers/report.ts Removed Reference https://github.com/Openpanel-dev/openpanel/commit/0a51b6805eed0b3da8376175acd5fa3d26819cb6 Removed Reference https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-3q95-vc6f-vc9v Removed Reference https://www.vulncheck.com/advisories/openpanel-report-list-queries-reports-by-an-unverified-dashboardid-crossing-organization-boundaries -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 26, 2026
Action Type Old Value New Value Added Reference https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-3q95-vc6f-vc9v Added SSVC {'id': 'CVE-2026-77769', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-26T17:22:58.316361Z'} -
New CVE Received by [email protected]
Aug. 21, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/Openpanel-dev/openpanel', 'vendor': 'Openpanel-dev', 'product': 'openpanel', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '0a51b6805eed0b3da8376175acd5fa3d26819cb6', 'versionType': 'git'}], 'programFiles': ['packages/trpc/src/routers/report.ts', 'packages/db/src/services/reports.service.ts'], 'defaultStatus': 'unaffected'}] Added Description The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied dashboardId belonged to that project, and getReportsByDashboardId in packages/db/src/services/reports.service.ts selects reports by dashboardId alone with no project scoping. An authenticated user could therefore pair a projectId from their own organization, which satisfies the middleware, with a dashboardId belonging to another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed in the same service file and resolves the dashboard through getDashboardById(dashboardId, projectId) before returning reports, but the router did not use it. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-639 Added Reference https://github.com/Openpanel-dev/openpanel Added Reference https://github.com/Openpanel-dev/openpanel/blob/e8a0602cda5a4d4b463f11d298a1b078c446bf33/packages/trpc/src/routers/report.ts Added Reference https://github.com/Openpanel-dev/openpanel/commit/0a51b6805eed0b3da8376175acd5fa3d26819cb6 Added Reference https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-3q95-vc6f-vc9v Added Reference https://www.vulncheck.com/advisories/openpanel-report-list-queries-reports-by-an-unverified-dashboardid-crossing-organization-boundaries