CVE-2026-116810GHSA-c98x-mph7-r6vpGHSA-vrrm-p9p4-2gfg
OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
Openpanel-dev openpanel
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.0.0openpanelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.
Text from CVE List
Affected versions 2
- openpanelaffected: all versions before 3.0.0CVE List
- openpanelunaffected: 3.0.0CVE List
References 4
- github.com/Openpanel-dev/openpanel/commit/7b88523798dcd2dcba53c39ca00f8a8c448377c3Fixvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-c98x-mph7-r6vpAdvisoryvia CVE List
- github.com/Openpanel-dev/openpanel/security/advisories/GHSA-vrrm-p9p4-2gfgAdvisoryvia CVE List
- vulncheck.com/advisories/openpanel-before-3.0.0-missing-authorization-via-reference-getchartreferencesAdvisoryvia CVE List