What’s Vulnerable › Vulnerabilities

CVE-2026-85615: Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-10-27
• Weakness: CWE-639

Description

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.

Affected products

• Openpanel-dev openpanel: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: Openpanel-dev openpanel 2.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-5cpv-vqvr-7mrh
• https://www.vulncheck.com/advisories/openpanel-before-2.3.0-cross-tenant-idor-via-report-getlayouts

Get alerted when CVE-2026-85615 or the next vulnerability affects your stack